SB20261108170 - Multiple vulnerabilities in Siebel CRM Deployment

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261108170

SB20261108170 - Multiple vulnerabilities in Siebel CRM Deployment

Published: November 8, 2026

Security Bulletin ID SB20261108170
CSH Severity
High
Patch available
YES
Number of vulnerabilities 30
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 37% Medium 43% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 30 vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2026-83216)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local authenticated user can exploit this vulnerability to execute arbitrary code.


2) Improper input validation (CVE-ID: CVE-2026-83196)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote privileged user can exploit this vulnerability to execute arbitrary code.


3) Improper input validation (CVE-ID: CVE-2026-83201)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


4) Improper input validation (CVE-ID: CVE-2026-83202)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


5) Improper input validation (CVE-ID: CVE-2026-83229)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Siebel Management Console component in Siebel CRM Deployment. A remote privileged user can exploit this vulnerability to execute arbitrary code.


6) Improper input validation (CVE-ID: CVE-2026-83180)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


7) Improper input validation (CVE-ID: CVE-2026-83199)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


8) Improper input validation (CVE-ID: CVE-2026-83153)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


9) Improper input validation (CVE-ID: CVE-2026-83208)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Migration component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


10) Improper input validation (CVE-ID: CVE-2026-83210)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


11) Improper input validation (CVE-ID: CVE-2026-83215)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


12) Improper input validation (CVE-ID: CVE-2026-83191)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


13) Improper input validation (CVE-ID: CVE-2026-82992)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation component in Siebel CRM Deployment. A local authenticated user can exploit this vulnerability to execute arbitrary code.


14) Improper input validation (CVE-ID: CVE-2026-83211)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local authenticated user can exploit this vulnerability to execute arbitrary code.


15) Improper input validation (CVE-ID: CVE-2026-83214)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local authenticated user can exploit this vulnerability to execute arbitrary code.


16) Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-ID: CVE-2026-54515)

CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to modify otherwise ignored object attributes.

The vulnerability exists due to improper control of dynamically determined object attributes in BeanDeserializerBase.createContextual() when processing case-insensitive deserialization with per-property @JsonIgnoreProperties exclusions. A remote attacker can send crafted JSON input to modify otherwise ignored object attributes.

Only applications that enable case-insensitive property matching and rely on per-property @JsonIgnoreProperties to keep a field unwritable are vulnerable.


17) Improper input validation (CVE-ID: CVE-2026-83183)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.


18) Improper input validation (CVE-ID: CVE-2026-83226)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


19) Improper input validation (CVE-ID: CVE-2026-83223)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Siebel Remote component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to execute arbitrary code.


20) Improper input validation (CVE-ID: CVE-2026-83222)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.


21) Improper input validation (CVE-ID: CVE-2026-83225)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.


22) Improper input validation (CVE-ID: CVE-2026-83228)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.


23) Improper input validation (CVE-ID: CVE-2026-83218)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


24) Improper input validation (CVE-ID: CVE-2026-83190)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local authenticated user can exploit this vulnerability to execute arbitrary code.


25) Improper input validation (CVE-ID: CVE-2026-83155)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read data or crash the application.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to read data or crash the application.


26) Improper input validation (CVE-ID: CVE-2026-83195)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote privileged user can exploit this vulnerability to execute arbitrary code.


27) Improper input validation (CVE-ID: CVE-2026-83224)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to read and manipulate data.


28) Improper input validation (CVE-ID: CVE-2026-83230)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Siebel Management Console component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to read and manipulate data.


29) Improper input validation (CVE-ID: CVE-2026-83219)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Server Infrastructure component in Siebel CRM Deployment. A local authenticated user can exploit this vulnerability to read and manipulate data.


30) Improper input validation (CVE-ID: CVE-2026-73965)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Cloud Gateway component in Siebel CRM Deployment. A remote authenticated user can exploit this vulnerability to read and manipulate data.


Remediation

Install update from vendor's website.

References