Siebel Apps - Marketing CVE-2026-46890

The vulnerable Siebel Apps - Marketing component (versions 17.0-26.5) must be deployed and its HTTP interface reachable by the attacker - Oracle confirms network access via HTTP is the sole prerequisite, with no authentication, no user interaction, and no non-default configuration required. Limiting factors are practical rather than technical: most Siebel CRM deployments sit behind enterprise reverse proxies or VPNs rather than directly on the internet, so reachability of the Marketing application's HTTP endpoint from an attacker-controlled network is the gating condition; deployments where the Marketing module is not installed or licensed are not exposed.

All available signals converge toward high real-world risk: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a trivially exploitable, unauthenticated, network-reachable flaw with total impact on the component, and Oracle's own characterization 'Easily exploitable… can result in takeover' reinforces low exploit complexity. Counterbalancing factors: EPSS data was not provided, the CVE is not on CISA KEV, and no public POC has been observed at time of analysis - consistent with a freshly disclosed Oracle CPU item where exploit development typically lags disclosure by days to weeks. The 'Information Disclosure' tag in the input conflicts with the description's 'takeover' wording and C:H/I:H/A:H impacts; the CVSS vector and Oracle's text should be treated as authoritative over the tag. Given Siebel CRM's heavy use in regulated industries (financial services, telecom, public sector) and historically slow patch cadence, defenders should treat this as priority-one for any internet-exposed Siebel deployment.

An attacker scans the internet (or a compromised internal network segment) for Siebel CRM web tiers exposing the Marketing application, then sends a single crafted HTTP request to the vulnerable endpoint without supplying any credentials, achieving full takeover of the Marketing component and pivoting into Siebel CRM data (customer lists, campaign data, PII). Because PR:N and AC:L apply, the operation requires no prior foothold and no user interaction; no public exploit identified at time of analysis, but Oracle CPU disclosures typically attract exploit development within weeks of publication.