What is the CVSS score of CVE-2026-46888?

CVE-2026-46888 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle Siebel CRM are affected by CVE-2026-46888?

Oracle Siebel CRM Deployment versions 17.0-26.5 contain a local privilege escalation vulnerability (CVE-2026-46888, CVSS 7.8) that allows any user with host logon access to fully compromise the CRM…

How to fix or mitigate CVE-2026-46888?

24 hours: Inventory all systems running Oracle Siebel CRM Deployment versions 17.0-26.5 and document current host user access. 7 days: Enforce OS-level host access restrictions, disable unnecessary local accounts on affected systems, and enable audit logging for privilege escalation attempts. 30 days: Monitor Oracle Critical Patch Update advisories for CVE-2026-46888 patch release; apply immediately upon availability. Escalate to Oracle support for mitigation roadmap pending patch availability.

Oracle Siebel CRM CVE-2026-46888

EUVD-2026-37380 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Siebel Crm Deployment Oracle Corporation

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local logon required (AV:L) with a low-privileged account (PR:L), no user interaction, and Oracle's own wording 'easily exploitable' supports AC:L; takeover of the deployment yields full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:27 vuln.today

DescriptionCVE.org

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Database Upgrade). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Local privilege escalation in Oracle Siebel CRM Deployment (Database Upgrade component) versions 17.0 through 26.5 allows a low-privileged user with logon access to the host running the deployment to fully compromise the Siebel CRM Deployment instance. The flaw carries a CVSS 3.1 base score of 7.8 with high impact across confidentiality, integrity, and availability, and was disclosed in the Oracle Critical Patch Update advisory (cspujun2026). No public exploit identified at time of analysis and no EPSS or KEV signal was provided.

Technical ContextAI

The affected component is the Database Upgrade sub-module of Oracle Siebel CRM Deployment, the tooling used to install, patch, and schema-migrate Siebel CRM environments. CPE data identifies cpe:2.3:a:oracle_corporation:siebel_crm_deployment as the impacted product family across all builds in the 17.0-26.5 train. No CWE was assigned by the reporter, but the CVSS shape (local vector, low privileges, no user interaction, unchanged scope, full CIA impact) is characteristic of insecure file or process handling within a privileged deployment/upgrade workflow - for example, an unsafe temporary file, world-writable script, weak ACL on an upgrade artifact, or a command/path injection executed by a higher-privileged deployment process.

RemediationAI

Apply the fixes shipped in the Oracle Critical Patch Update of June 2026 (cspujun2026) to all Siebel CRM Deployment instances in the 17.0-26.5 range; consult https://www.oracle.com/security-alerts/cspujun2026.html for the exact patch IDs that correspond to your installed version, as the input data does not name a specific fixed build (Patch available per vendor advisory). Until the CPU is applied, compensating controls should focus on the local attack surface: restrict interactive and remote-shell logon on hosts that run Siebel CRM Deployment to a minimal set of named admin accounts, audit and tighten filesystem ACLs on Siebel deployment directories and upgrade artifacts so that low-privileged users cannot read or modify them, and segregate the Siebel upgrade host from general-purpose application or jump-box use. The trade-off is reduced operational flexibility for shared admin or DBA teams and additional access-management overhead, but it directly removes the AV:L/PR:L precondition the vulnerability requires.