What is the CVSS score of CVE-2026-46925?

CVE-2026-46925 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle Siebel CRM are affected by CVE-2026-46925?

Oracle Siebel CRM Cloud Applications versions 17.0-26.5 are vulnerable to complete remote compromise and lateral movement to connected systems through the Siebel Cloud Manager component.

How to fix or mitigate CVE-2026-46925?

Exploitation status: no public exploit identified at time of analysis. 24 hours: Inventory all Siebel CRM Cloud instances (versions 17.0-26.5), document their network segments, and verify current access controls to the Siebel Cloud Manager component. Assess network adjacency risk in your environment. 7 days: Deploy firewall rules restricting access to Siebel Cloud Manager to authorized administrative networks only; enable comprehensive audit logging of all connections and authentication events. 30 days: Monitor vendor advisories for patch release; establish isolated test environment to validate patch when available; develop and execute emergency patching timeline.

Oracle Siebel CRM CVE-2026-46925

EUVD-2026-37241 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Siebel Crm Cloud Applications Authentication Bypass

8.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.3 HIGH

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Adjacent layer-2 access required (AV:A), high complexity preconditions (AC:H), unauthenticated and no user interaction, with scope change enabling full C/I/A compromise of Siebel and integrated products.

3.1 AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:08 vuln.today

DescriptionCVE.org

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Adjacent-network takeover of Oracle Siebel CRM Cloud Applications (versions 17.0 through 26.5) is possible via the Siebel Cloud Manager component, where an unauthenticated attacker on the same physical communication segment can fully compromise the application and pivot to other products through a scope change. The flaw carries a CVSS 3.1 base score of 8.3 with full confidentiality, integrity, and availability impact, but high attack complexity. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Gain foothold on adjacent network segment

Delivery

Enumerate Siebel Cloud Manager service

Exploit

Send crafted adjacent-network traffic

Install

Bypass high-complexity preconditions

Compromise Cloud Manager process

Execute

Pivot via scope change to integrated products

Impact

Take over Siebel CRM Cloud Applications

Recon

Gain foothold on adjacent network segment

Delivery

Enumerate Siebel Cloud Manager service

Exploit

Send crafted adjacent-network traffic

Install

Bypass high-complexity preconditions

Compromise Cloud Manager process

Execute

Pivot via scope change to integrated products

Impact

Take over Siebel CRM Cloud Applications

Vulnerability AssessmentAI

Exploitation	Attacker must have access to the physical (or layer-2 logical) communication segment attached to the hardware running Siebel CRM Cloud Applications - typically the same VLAN, virtual switch, or broadcast domain as the Siebel Cloud Manager host - and must operate against a supported version between 17.0 and 26.5. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are mixed: CVSS 3.1 is High (8.3) due to full C/I/A impact and scope change, but the attack vector is Adjacent (AV:A) and attack complexity is High (AC:H), meaning the attacker must be on the same physical/logical communication segment and overcome non-trivial conditions to succeed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who has gained a foothold on a virtual machine, container, or hardware node sharing the same layer-2 communication segment as a Siebel Cloud Manager host crafts adjacent-network traffic targeting the manager, overcoming the high-complexity preconditions to coerce it into a state that yields full control. Because the vulnerability produces a scope change, the attacker then leverages the compromised Cloud Manager to reach and impact additional integrated products such as backend databases, identity services, or other Oracle cloud components colocated on the same trust boundary. …
Remediation	Patch available per vendor advisory: apply the fixes from the Oracle June 2026 Siebel Cloud Patch Update at https://www.oracle.com/security-alerts/cspujun2026.html, which addresses all supported releases in the 17.0-26.5 range. … Detailed patch versions, workarounds, and compensating controls in full report.