What is the CVSS score of CVE-2026-46919?

CVE-2026-46919 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-46919?

Within 24 hours: Inventory all deployed instances of Oracle Siebel CRM Cloud (17.0-26.5) and restrict HTTP/HTTPS access to the Siebel Cloud Manager component to internal networks only using firewall rules. Within 7 days: Deploy Web Application Firewall (WAF) rules to monitor and block suspicious Cloud Manager access; implement enhanced logging and alerting for all access attempts; contact Oracle Support for interim mitigation guidance and patch ETA. Within 30 days: Evaluate upgrade paths to Siebel CRM versions beyond 26.5; assess business continuity impact of temporary suspension of affected systems if necessary; implement continuous vulnerability scanning and exploitation indicator monitoring.

Siebel CRM Cloud Applications CVE-2026-46919

EUVD-2026-37237 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Siebel Crm Cloud Applications Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify exposed Siebel Cloud Manager endpoint
Delivery

Send crafted unauthenticated HTTP request
Exploit

Trigger flaw in Cloud Manager component
Execution

Gain control of Siebel CRM application
Impact

Exfiltrate CRM data and pivot

Vulnerability Assessment

Weakness	CWE CWE-306 MITRE ATT&CK 1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation against default configurations of Siebel CRM Cloud Applications, requiring only HTTP reachability to the Siebel Cloud Manager component (CVSS AV:N/AC:L/PR:N/UI:N). The only limiting factor is network exposure of the Cloud Manager endpoint: deployments where Siebel Cloud Manager is firewalled to internal management networks substantially reduce the attack surface, while any tenant exposing Cloud Manager to the public internet is directly reachable. Affected versions are constrained to Siebel CRM Cloud Applications 17.0 through 26.5; on-premises classic Siebel CRM deployments without the Cloud Manager component are not in scope of this CVE.
Impact	All available signals point to a top-priority issue: CVSS 9.8 with network vector, low complexity, no privileges, and no user interaction, plus Oracle's own description calling exploitation 'easy' and the outcome 'takeover'. Scope is Unchanged but C/I/A are all High, so a single tenant or instance is fully compromised. EPSS and CISA KEV are not provided in the input, and no public exploit identified at time of analysis, so widespread automated exploitation is not yet confirmed - however, Oracle Critical Patch Updates historically attract exploit development within days to weeks, and the 'Information Disclosure' tag in the input understates the real impact described in the CVSS vector. One signal worth flagging: the 'Information Disclosure' tag conflicts with the C:H/I:H/A:H vector and the 'takeover' language; defenders should trust the CVSS vector and advisory wording, not the tag.
Exploit ScenarioDerived	An external attacker discovers an internet-reachable Siebel CRM Cloud Applications instance, sends a crafted HTTP request to the Siebel Cloud Manager component without authenticating, and gains full takeover of the application. From there the attacker can exfiltrate CRM data, manipulate customer records, or pivot into the hosting environment. No public exploit identified at time of analysis, but Oracle's own 'easily exploitable' wording makes weaponization plausible once the patch is reverse-engineered.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 16, 2026

Remote takeover of Oracle Siebel CRM Cloud Applications (versions 17.0 through 26.5) allows unauthenticated network attackers to fully compromise the Siebel Cloud Manager component via HTTP. The flaw carries a CVSS 9.8 with low attack complexity and no privileges or user interaction required, putting confidentiality, integrity, and availability at high risk. No public exploit identified at time of analysis, but Oracle's own advisory characterizes exploitation as easy.

RemediationAI

Apply the fixes bundled in the Oracle Critical Security Patch Update of June 2026 documented at https://www.oracle.com/security-alerts/cspujun2026.html - patch available per vendor advisory, though an exact fixed build number was not provided in the input data. Until the CPU is deployed, restrict network reachability of the Siebel Cloud Manager HTTP endpoints to trusted management networks and VPN-only access, place a WAF or reverse proxy with strict allow-listing in front of any internet-exposed Siebel Cloud Manager interfaces, and increase monitoring of Siebel administrative and provisioning endpoints for anomalous unauthenticated POST traffic. Note that network restrictions may break legitimate cloud orchestration workflows and tenant self-service flows, so coordinate with Siebel administrators before enforcing.

Affected VersionsENISA

Siebel CRM Cloud Applications 17.0 ≤26.5

Affected Packages

euvd siebel_crm_cloud_applications no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability sits in the Siebel Cloud Manager component of Oracle's Siebel CRM Cloud Applications, the SaaS-style deployment of Oracle's long-standing Siebel CRM platform. Siebel Cloud Manager handles cloud provisioning and orchestration tasks and exposes HTTP-based interfaces, making it a high-value entry point for tenant compromise. CWE is not assigned in the input, but the CVSS profile (AV:N/AC:L/PR:N/UI:N with full C/I/A impact and unchanged scope) combined with Oracle's 'takeover' phrasing is consistent with an authentication bypass or unauthenticated remote code execution class flaw rather than a single-impact disclosure. The CPE 'cpe:2.3:a:oracle_corporation:siebel_crm_cloud_applications:*' covers the entire product line with no version segmentation, indicating Oracle is treating all supported releases as in-scope.

Know when Siebel Crm Cloud Applications gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Oracle advisory confirms easily exploitable unauthenticated HTTP-reachable takeover with full C/I/A impact and no scope change to other components.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle Siebel CRM Cloud Applications (versions 17.0-26.5) contain a critical remote takeover vulnerability enabling unauthenticated attackers to fully compromise the Siebel Cloud Manager component via unprotected HTTP access. Without an available vendor patch, organizations using affected versions face immediate and complete risk to CRM data confidentiality, system integrity, and operational availability. This vulnerability demands urgent network isolation and direct vendor engagement to establish a remediation timeline.

Business Impact: Severe

Compensating Controls

Network segmentation isolating Siebel Cloud Manager from public internet; firewall and WAF rules restricting HTTP access to trusted internal networks only; enhanced logging and alerting on all access attempts to affected components; consider temporary operational suspension of critical Siebel instances pending patch availability; direct engagement with Oracle Support for interim hardening recommendations and confirmed patch release timeline.

Threat Intelligence Overview

EPSS Score

0.5%

Top 62% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.