What is the CVSS score of CVE-2026-46926?

CVE-2026-46926 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle Siebel CRM are affected by CVE-2026-46926?

Oracle Siebel CRM Cloud Applications (versions 17.0-26.5) contain a privilege escalation vulnerability enabling low-privileged attackers with host access to achieve complete system takeover, with…

How to fix or mitigate CVE-2026-46926?

Within 24 hours: Identify all Siebel CRM Cloud Application instances running versions 17.0-26.5 and restrict host logon access to essential administrators only. Within 7 days: Apply Oracle's June 2026 Critical Patch Update to all affected instances and verify patch deployment. Within 30 days: Review Siebel host access logs for unauthorized privilege escalation attempts and conduct post-patch security assessment.

Oracle Siebel CRM CVE-2026-46926

EUVD-2026-37242 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Siebel Crm Cloud Applications Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Description explicitly requires local logon (AV:L) with an existing low-privileged account (PR:L), exploitation is easy (AC:L), no user interaction, and full takeover with scope change drives S:C and C/I/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:07 vuln.today

DescriptionCVE.org

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation and full takeover of Oracle Siebel CRM Cloud Applications (versions 17.0 through 26.5) is possible for a low-privileged attacker with logon access to the host infrastructure, via the Siebel Cloud Manager component. Successful exploitation produces a scope change that significantly impacts adjacent products beyond Siebel itself, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but Oracle has issued a fix in its June 2026 Critical Patch Update.

Technical ContextAI

The vulnerable component is Siebel Cloud Manager, the orchestration and provisioning subsystem of Oracle Siebel CRM Cloud Applications (CPE cpe:2.3:a:oracle_corporation:siebel_crm_cloud_applications). Siebel Cloud Manager runs as a privileged service on the Siebel application infrastructure and brokers configuration, deployment, and cross-component management calls, which is why successful abuse causes a CVSS scope change - actions taken inside the vulnerable component reach authorization boundaries of other Siebel and downstream cloud-managed products. No CWE has been assigned by Oracle, but the AV:L/PR:L profile together with scope change is consistent with an authorization or privilege-management flaw exploitable by any logged-in OS- or application-tier user on the Siebel host.

RemediationAI

Apply the fixes from Oracle's June 2026 Critical Patch Update for Siebel CRM Cloud Applications (Patch available per vendor advisory at https://www.oracle.com/security-alerts/cspujun2026.html); Oracle's CPU is the authoritative source for the exact patched build numbers per Siebel release, which should be matched to your deployed version in the 17.0-26.5 range. Until the CPU is deployed, reduce the local-access prerequisite by tightening OS- and application-level account hygiene on Siebel infrastructure hosts: remove unused interactive logins, enforce MFA on jump hosts and bastions used to reach Siebel servers, and restrict shell access to a small named admin group (trade-off: may break existing operator runbooks and automation that share logins). Additionally, restrict and monitor invocations of the Siebel Cloud Manager management endpoints and increase audit logging on the Siebel app tier so any low-privilege user attempting Cloud Manager operations is detected (trade-off: increased log volume and potential alert noise during routine maintenance windows).