Oracle Siebel CRM CVE-2026-46888

Attacker must already hold a valid low-privileged OS-level logon on the specific host where the Siebel CRM Deployment / Database Upgrade component executes (AV:L, PR:L); the target must be running Oracle Siebel CRM Deployment version 17.0 through 26.5 with the unpatched Database Upgrade component present. No user interaction is required (UI:N) and attack complexity is low (AC:L), but exploitation is not possible from the network and not possible from accounts with no shell or service access to the deployment host, which materially limits exposure on environments that restrict administrative logon.

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes an easily exploitable local attack by an already-authenticated low-privileged user that yields complete takeover of the deployment component - a classic local privilege escalation pattern rather than a remote internet-facing risk. The 7.8 score is meaningful inside a Siebel administration host, but the AV:L constraint sharply limits blast radius: an attacker must already be on the infrastructure where Siebel CRM Deployment runs. No EPSS score, KEV listing, or public POC was supplied in the intelligence package, so there is no public exploit identified at time of analysis; the 'Information Disclosure' tag is inconsistent with the C:H/I:H/A:H vector (which implies far more than disclosure) and should be treated as imprecise vendor tagging, not as a downgrade of the actual impact. Realistic priority: high for hosts where untrusted or low-trust OS accounts exist alongside the Siebel deployment tooling (lab, shared admin, or multi-tenant servers); moderate for tightly access-controlled production deployment hosts.

An operator, DBA, or compromised service account with ordinary low-privilege logon to a Siebel CRM Deployment host triggers the vulnerable Database Upgrade code path - for example by invoking, racing, or substituting a file or argument consumed by a higher-privileged deployment process - and gains full control over the Siebel CRM Deployment instance, allowing tampering with upgrade scripts, schema content, and connection credentials. No public exploit identified at time of analysis, so an attacker would need to reverse-engineer the patched component or rely on internal knowledge of the upgrade workflow.