Oracle Siebel CRM CVE-2026-46925

Attacker must have access to the physical (or layer-2 logical) communication segment attached to the hardware running Siebel CRM Cloud Applications - typically the same VLAN, virtual switch, or broadcast domain as the Siebel Cloud Manager host - and must operate against a supported version between 17.0 and 26.5. Authentication is not required (PR:N) and no user interaction is needed (UI:N), but the high attack complexity (AC:H) indicates exploitation depends on specific timing, configuration, or other conditions outside the attacker's direct control, which materially limits opportunistic abuse. Internet-only attackers without adjacent-segment presence cannot reach this flaw.

Signals are mixed: CVSS 3.1 is High (8.3) due to full C/I/A impact and scope change, but the attack vector is Adjacent (AV:A) and attack complexity is High (AC:H), meaning the attacker must be on the same physical/logical communication segment and overcome non-trivial conditions to succeed. There is no CISA KEV listing, no EPSS score provided, no SSVC data, and no public POC indicator in the input, so real-world exploitation pressure currently appears low despite the severe impact. The most notable risk amplifier is the scope change to 'additional products,' which means a successful exploit could compromise integrated systems beyond Siebel itself - defenders running Siebel in flat or poorly segmented cloud networks should treat this as a meaningful priority, while those with strict tenant isolation can reasonably schedule it in the normal Oracle CPU patch cycle.

An attacker who has gained a foothold on a virtual machine, container, or hardware node sharing the same layer-2 communication segment as a Siebel Cloud Manager host crafts adjacent-network traffic targeting the manager, overcoming the high-complexity preconditions to coerce it into a state that yields full control. Because the vulnerability produces a scope change, the attacker then leverages the compromised Cloud Manager to reach and impact additional integrated products such as backend databases, identity services, or other Oracle cloud components colocated on the same trust boundary. No public exploit identified at time of analysis.