Oracle Siebel CRM CVE-2026-46889

No special conditions - remote unauthenticated exploitation over HTTP against any supported deployment of Oracle Siebel Apps - Marketing in the version range 17.0 to 26.5, per CVSS AV:N/AC:L/PR:N/UI:N. The only practical limiting factors are network reachability to the Marketing component's HTTP listener (often deployed behind enterprise reverse proxies or VPNs rather than directly on the public internet) and that the target must be running the Marketing module specifically, not just core Siebel CRM. No authentication, configuration toggle, or user interaction is required.

All available signals point to high real-world risk: CVSS 3.1 base score of 9.8 with the most severe vector possible (network, low complexity, no privileges, no user interaction, full CIA impact), Oracle-issued advisory, and a wide supported-version range spanning roughly nine years of releases. However, there is no EPSS score, no CISA KEV listing, and no public POC referenced in the input - exploitation is currently theoretical based on Oracle's self-disclosure. The 'Information Disclosure' tag understates the actual scope (full takeover per the description), and the lack of CWE means the root cause class must be inferred. Real-world risk is elevated by Siebel's typical deployment as an internet-facing or DMZ application in regulated enterprises, where compromise would expose marketing data, customer PII, and lateral pivot opportunities.

An attacker on the internet (or in a partner network with HTTP reachability to the Siebel Marketing tier) sends a crafted HTTP request to a vulnerable endpoint and obtains code execution or administrative control over the Marketing component without any credentials or user interaction. From there they exfiltrate campaign lists and customer PII, tamper with outbound marketing communications, and pivot into the broader Siebel CRM database. No public exploit identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector indicates a trivial single-request exploit is feasible once details are reverse-engineered from the Oracle patch.