What is the CVSS score of CVE-2026-46921?

CVE-2026-46921 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Siebel CRM are affected by CVE-2026-46921?

Oracle Siebel CRM Cloud Applications versions 17.0 through 26.5 contain a critical account takeover vulnerability in Siebel Cloud Manager that allows low-privilege remote attackers to fully…

How to fix or mitigate CVE-2026-46921?

Within 24 hours: Audit all Siebel deployments to identify affected versions (17.0-26.5) and map network exposure. Within 7 days: Implement network segmentation restricting Siebel Cloud Manager access to authorized IP ranges, enforce multi-factor authentication on all administrative accounts, and enable real-time suspicious activity monitoring. Within 30 days: Contact Oracle for patch timeline and risk assessment; evaluate Web Application Firewall (WAF) deployment for additional attack prevention; consider temporary suspension of internet-facing access where operationally feasible pending patch release.

Oracle Siebel CRM CVE-2026-46921

EUVD-2026-37239 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Siebel Crm Cloud Applications Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

HTTP-reachable management component (AV:N), Oracle states easily exploitable (AC:L), requires a low-privileged Siebel account (PR:L), no user interaction, and yields full takeover (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:09 vuln.today

DescriptionCVE.org

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle Siebel CRM Cloud Applications versions 17.0 through 26.5 allows a low-privileged remote attacker to fully compromise the Siebel Cloud Manager component over HTTP. Oracle rates the flaw 8.8 with full CIA impact, and no public exploit identified at time of analysis, but the low attack complexity and low privilege requirement make this a high-priority patch for any internet-exposed Siebel deployment.

Technical ContextAI

Oracle Siebel CRM Cloud Applications is Oracle's hosted customer relationship management suite, and the affected component - Siebel Cloud Manager - is the management/orchestration layer responsible for provisioning, configuring, and administering Siebel cloud tenants over HTTP. The advisory does not disclose a CWE, but the combination of network-reachable HTTP service, low privilege requirement, and full confidentiality/integrity/availability impact is consistent with an authorization or input-handling flaw in an authenticated management endpoint that lets an ordinary tenant user escalate to administrative control over the application stack. The single affected CPE (cpe:2.3:a:oracle_corporation:siebel_crm_cloud_applications) and the broad 17.0-26.5 version band indicate a long-standing defect in the Cloud Manager codepath rather than a regression in a recent release.

RemediationAI

Apply the fixes delivered in Oracle's June 2026 Critical Patch Update for Siebel CRM as documented at https://www.oracle.com/security-alerts/cspujun2026.html - the specific patched build number is not enumerated in the advisory metadata supplied here, so confirm the exact fix level against the CPU matrix before deployment (Patch available per vendor advisory). Until the CPU is applied, restrict network reachability of the Siebel Cloud Manager HTTP endpoints to trusted management networks or VPN only (trade-off: breaks remote administrator and partner access), tighten role assignments so that ordinary CRM end-users cannot reach Cloud Manager URLs at all (trade-off: requires a role-permission audit and may surface latent integrations), rotate credentials of any low-privileged accounts whose compromise would now be sufficient for takeover, and enable HTTP request logging on the Cloud Manager tier so post-patch you can retrohunt for pre-fix abuse.