What is the CVSS score of CVE-2026-46886?

CVE-2026-46886 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Siebel CRM are affected by CVE-2026-46886?

Oracle Siebel Marketing (versions 17.0-26.5) contains a high-severity vulnerability allowing any low-privileged Siebel user to seize complete control of customer data, campaigns, and system…

How to fix or mitigate CVE-2026-46886?

Within 24 hours: audit all Siebel Marketing instances running versions 17.0-26.5 and inventory active user accounts with administrative or elevated privileges. Within 7 days: enforce network isolation of Siebel Marketing via firewall IP whitelisting; deploy real-time monitoring for suspicious authentication patterns, privilege elevation, and bulk data access. Within 30 days: escalate to Oracle for patch timeline and availability; assess operational feasibility of disabling the Marketing module; rotate credentials across all Siebel accounts and enforce multi-factor authentication for administrative access.

Oracle Siebel CRM CVE-2026-46886

EUVD-2026-37378 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Siebel Apps Marketing Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP vector, low complexity, requires a low-privileged Siebel account (PR:L), no user interaction, and vendor describes full component takeover so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:28 vuln.today

DescriptionCVE.org

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in takeover of Siebel Apps - Marketing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Authenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) allows a low-privileged attacker with HTTP network access to fully compromise confidentiality, integrity, and availability of the Marketing component. Oracle rates this 8.8 CVSS 3.1 with low attack complexity and no user interaction, making it an easy-win post-authentication vulnerability against any reachable Siebel Marketing instance. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.

Technical ContextAI

Oracle Siebel CRM is an enterprise customer relationship management suite; the Marketing module (Siebel Apps - Marketing) handles campaign management, segmentation, and outbound marketing workflows, typically exposed through a web tier that authenticates Siebel users over HTTP/HTTPS. The CPE cpe:2.3:a:oracle_corporation:siebel_apps_-_marketing covers all supported releases from 17.0 up to and including 26.5, indicating a long-lived flaw in shared Marketing component code rather than a regression in a single release. No CWE was assigned by Oracle (consistent with Oracle's Critical Patch Update style of minimal technical disclosure), but the combination of network vector, low privileges, low complexity, and full CIA impact described as 'takeover' is characteristic of authorization bypass, insecure deserialization, or server-side injection in an authenticated web interface.

RemediationAI

Patch available per vendor advisory: apply the fixes shipped in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) for every Siebel Apps - Marketing instance in the 17.0-26.5 range - the input does not contain an exact fixed version string, so consult the CPU patch matrix for the precise patchset for each running release. Until patching, reduce exposure by restricting network reachability of the Siebel Marketing web tier to trusted corporate networks or a VPN (trade-off: breaks remote marketing user access), tightening Siebel role/responsibility assignments so fewer accounts hold even low Marketing privileges (trade-off: may block legitimate campaign work), and increasing monitoring of authenticated Marketing HTTP requests and Siebel audit logs for anomalous activity (trade-off: detective, not preventive). Disabling the Marketing module entirely is an option only where it is unused, as it will halt campaign and segmentation functionality.