What is the CVSS score of CVE-2026-47018?

CVE-2026-47018 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Siebel CRM are affected by CVE-2026-47018?

Oracle Siebel CRM Cloud Manager versions 22.3-26.5 are vulnerable to an unauthenticated denial-of-service attack that can completely disable the application, with no vendor patch available.

How to fix or mitigate CVE-2026-47018?

Within 24 hours, inventory all Oracle Siebel CRM Cloud Manager instances to identify those in the affected version range (22.3-26.5); enable network-level rate limiting and HTTPS traffic inspection on Siebel endpoints; and establish incident response escalation procedures for application availability events. Within 7 days, deploy Web Application Firewall rules to detect and block malformed HTTPS requests targeting Siebel Cloud Manager, enable real-time monitoring for application hangs and crashes, and document manual restart procedures for rapid service restoration. Within 30 days, implement multi-instance deployment with load balancing to improve resilience, evaluate upgrade feasibility or alternative CRM platforms, and establish performance baselines to detect attack patterns.

Oracle Siebel CRM CVE-2026-47018

EUVD-2026-46507 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-vjr3-852x-r77q

Denial Of Service Oracle Siebel Crm Cloud Applications Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network HTTPS reach with low complexity and no user interaction (AV:N/AC:L/PR:N/UI:N); impact is complete availability loss only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:22 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) allows an unauthenticated remote attacker to send crafted HTTPS traffic that hangs or repeatedly crashes the application, producing a complete availability loss. The flaw carries a CVSS 3.1 base score of 7.5 with pure availability impact and no confidentiality or integrity effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected technology is Oracle Siebel CRM, an enterprise customer-relationship-management suite, specifically the Siebel Cloud Manager component that orchestrates cloud deployment and lifecycle operations for the Cloud Applications product. The vulnerability is reached over HTTPS (network-facing web/application tier), and per the CPE cpe:2.3:a:oracle_corporation:siebel_crm_cloud_applications the impacted product is the Siebel CRM Cloud Applications package. No CWE was supplied, so the exact root-cause class is unstated; the availability-only impact (A:H, C:N, I:N) combined with 'hang or frequently repeatable crash' is consistent with an uncontrolled-resource-consumption or unhandled-exception style flaw (CWE-400/CWE-248 family) reachable without authentication, though this classification is inferred rather than confirmed by the vendor.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026 as the primary fix; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patched build applicable to your Siebel CRM Cloud Applications release (patch available per vendor advisory - an exact fixed version string was not included in the input, so verify it in the CPU document). Because the vector is network/HTTPS and unauthenticated, effective compensating controls until patching include restricting network access to the Siebel Cloud Manager endpoint via firewall or allow-list so only trusted management networks can reach it (trade-off: may block legitimate remote administration), placing the application behind a WAF or reverse proxy with rate-limiting and request validation to blunt crash-triggering traffic (trade-off: tuning required and may not fully block a malformed-request crash), and ensuring process/service auto-restart and monitoring so a crash-induced hang is detected and recovered quickly (trade-off: mitigates duration, not the underlying trigger). Do not expose Siebel Cloud Manager directly to the public internet if it is not operationally required.