What is the CVSS score of CVE-2026-47036?

CVE-2026-47036 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-47036?

Within 24 hours: conduct a complete inventory of all Oracle Siebel CRM deployments (production, development, testing) identifying versions and documenting business criticality and network accessibility. Within 7 days: enforce network-level access restrictions via firewall rules limiting HTTP/HTTPS traffic to Siebel CRM to whitelisted business users and systems only; deploy web application firewall signatures to block suspicious HTTP patterns; enable comprehensive logging of all Siebel network activity for threat detection. Within 30 days: subscribe to Oracle security bulletins and monitor for CVE-2026-47036 patch release; prepare and test patch deployment procedures in non-production environments; execute vendor patch to all affected systems within 72 hours of availability.

Oracle Siebel CRM CVE-2026-47036

EUVD-2026-46523 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-gfcm-5mp4-vvxw

Authentication Bypass Oracle Siebel Crm Development Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach Siebel HTTP tier over network
Delivery

Send crafted request to Approval Manager
Exploit

Trigger unauthenticated flaw
Execution

Gain code/data control
Impact

Take over Siebel CRM Development instance

Vulnerability Assessment

Weakness	CWE CWE-306 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Authentication required for critical functions MITRE ATT&CK 1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation against Oracle Siebel CRM (Siebel CRM Development, Siebel Approval Manager component) over HTTP, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The primary prerequisite is network reachability of the Siebel HTTP application/web tier hosting the Siebel Approval Manager component on an affected version (17.0-26.3). Limiting factors: the target must be an installation exposing the vulnerable Approval Manager over HTTP, and organizations that keep the Siebel tier internal-only or behind VPN/WAF significantly reduce exposure; no authentication, user interaction, or non-default configuration is required by the vector.
Impact	The signals point to a genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the C:H/I:H/A:H impact reflects full system takeover, yielding the 9.8 score. However, key corroborating data is missing - no EPSS probability, no CWE, no SSVC decision point, and no KEV listing were supplied, so the score cannot be triangulated against exploitation likelihood. No public proof-of-concept or active exploitation is indicated, suggesting the risk is currently potential rather than demonstrated. Note a conflict worth verifying: the supplied Tags include 'Information Disclosure,' which understates the described full-takeover impact and the C:H/I:H/A:H vector - treat the tag as imprecise metadata and rely on the CVSS vector and Oracle's 'takeover' language. Oracle CPU advisories are terse, so the exact exploitation mechanism should be confirmed against the vendor bulletin.
Exploit ScenarioDerived	An attacker with only network access to the Siebel web tier sends a crafted HTTP request to the Siebel Approval Manager component, requiring no credentials and no user interaction. Because attack complexity is low, the request drives the flaw to full compromise, letting the attacker read or alter CRM data and take over the Siebel CRM Development instance. No public exploit code is known at this time, so exploitation would currently require independent research or reverse-engineering of the patch.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 21, 2026

Remote takeover of Oracle Siebel CRM (Siebel CRM Development, Siebel Approval Manager component) is possible by an unauthenticated attacker sending crafted HTTP requests, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, affecting supported versions 17.0 through 26.3. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list, but the unauthenticated network-facing profile makes it a high-priority patch item.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory; Oracle does not publish a discrete fixed-version string in the supplied data, so obtain the applicable patch for your Siebel release from https://www.oracle.com/security-alerts/cpujul2026.html and Oracle Support). Because exploitation is unauthenticated over HTTP, until patching is complete restrict network reachability of the Siebel application/web tier - place it behind a VPN or restrict source IPs, and use a WAF or reverse proxy to filter and rate-limit access to the Siebel Approval Manager endpoints; the trade-off is that legitimate remote or partner access to Siebel may be disrupted and must be allowlisted. Increase logging and monitoring of the Siebel HTTP tier for anomalous requests as a detective control. Do not rely on network controls alone as a permanent substitute for the Oracle patch.

Affected VersionsENISA

Siebel CRM Development 17.0 ≤26.3

Affected Packages

euvd siebel_crm_development no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle Siebel CRM is a large enterprise customer relationship management suite; the affected element is the Siebel Approval Manager component within the Siebel CRM Development product, reachable over HTTP as part of the Siebel web/application server tier. Oracle does not publish a CWE for this entry (CWE listed as N/A) and provides no technical root-cause detail beyond the CVSS vector, which is typical of Oracle Critical Patch Update advisories. Because the CVSS scope is Unchanged (S:U) yet impact is complete across C/I/A, the vulnerable component and the impacted component are the same, consistent with a flaw in the HTTP-facing Siebel application logic that grants attacker control of the Siebel CRM Development instance itself. The affected product is identified by CPE cpe:2.3:a:oracle_corporation:siebel_crm_development:*.

Know when Siebel Crm Development gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Oracle describes unauthenticated HTTP-based takeover with no user interaction, giving AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H; scope unchanged as the Siebel component is itself the impacted system.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager). Supported versions that are affected are 17.0-26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development. Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle Siebel CRM instances running versions 17.0-26.3 are subject to unauthenticated remote takeover through the Approval Manager component, enabling complete system compromise without credentials or authentication barriers. No vendor patch currently exists. Organizations relying on Siebel for customer operations and business approvals face immediate risk of data theft, service disruption, and operational hijacking; emergency containment measures are required before patch availability.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Implement strict network segmentation and firewall rules to limit Siebel CRM access to essential business systems and users; deploy web application firewall rulesets targeting exploitation patterns in the Siebel Approval Manager component; establish 24/7 monitoring and logging of Siebel traffic with alerting for anomalous HTTP requests; consider temporary operational isolation of non-critical development and testing instances until patch deployment is feasible.

Threat Intelligence Overview

EPSS Score

0.4%

Top 72% exploitable

Prevalence

Medium

established enterprise CRM suite, common in large orgs but not ubiquitous

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.