## Summary
Oracle Siebel CRM Integration (component EAI) contains a vulnerability (CVE-2026-83221) affecting supported versions 17.0-26.7. An attacker with low privileges and network access can exploit the issue via SOAP to compromise Siebel CRM Integration.
## Technical Details
- Attack surface: SOAP endpoints exposed by Siebel CRM Integration.
- Preconditions: attacker has low privileges and network access.
- Exploitability: described as easily exploitable with AC:L and PR:L (per NVD).
- Likely outcomes (as stated by NVD): unauthorized access to critical data and potential complete access to Siebel CRM Integration accessible data, plus unauthorized update/insert/delete of some accessible data.
## Affected
- Oracle Siebel CRM Integration (EAI component), versions 17.0-26.7.
## Impact
- Confidentiality: C:H (high impact) — unauthorized access to critical/accessible data.
- Integrity: I:L (low impact) — unauthorized update/insert/delete of some data.
- Availability: A:N (no availability impact indicated by NVD).
## Mitigation
1. Patch immediately to the vendor-provided fixed version for Oracle Siebel CRM Integration (EAI) covering versions 17.0-26.7.
2. Restrict network access to SOAP interfaces so only trusted clients/systems can reach them.
3. Review and monitor for suspicious SOAP requests and anomalous data access/modification patterns in Siebel CRM Integration logs.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N