What is the CVSS score of EUVD-2026-37237?

EUVD-2026-37237 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Siebel CRM Cloud Applications are affected by EUVD-2026-37237?

Oracle Siebel CRM Cloud Applications (versions 17.0-26.5) contain a critical remote takeover vulnerability enabling unauthenticated attackers to fully compromise the Siebel Cloud Manager component…

How to fix or mitigate EUVD-2026-37237?

Within 24 hours: Inventory all deployed instances of Oracle Siebel CRM Cloud (17.0-26.5) and restrict HTTP/HTTPS access to the Siebel Cloud Manager component to internal networks only using firewall rules. Within 7 days: Deploy Web Application Firewall (WAF) rules to monitor and block suspicious Cloud Manager access; implement enhanced logging and alerting for all access attempts; contact Oracle Support for interim mitigation guidance and patch ETA. Within 30 days: Evaluate upgrade paths to Siebel CRM versions beyond 26.5; assess business continuity impact of temporary suspension of affected systems if necessary; implement continuous vulnerability scanning and exploitation indicator monitoring.

Siebel CRM Cloud Applications EUVD-2026-37237

| CVE-2026-46919 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Oracle Siebel Crm Cloud Applications Authentication Bypass

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle advisory confirms easily exploitable unauthenticated HTTP-reachable takeover with full C/I/A impact and no scope change to other components.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:10 vuln.today

DescriptionCVE.org

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Siebel CRM Cloud Applications (versions 17.0 through 26.5) allows unauthenticated network attackers to fully compromise the Siebel Cloud Manager component via HTTP. The flaw carries a CVSS 9.8 with low attack complexity and no privileges or user interaction required, putting confidentiality, integrity, and availability at high risk. No public exploit identified at time of analysis, but Oracle's own advisory characterizes exploitation as easy.

Technical ContextAI

The vulnerability sits in the Siebel Cloud Manager component of Oracle's Siebel CRM Cloud Applications, the SaaS-style deployment of Oracle's long-standing Siebel CRM platform. Siebel Cloud Manager handles cloud provisioning and orchestration tasks and exposes HTTP-based interfaces, making it a high-value entry point for tenant compromise. CWE is not assigned in the input, but the CVSS profile (AV:N/AC:L/PR:N/UI:N with full C/I/A impact and unchanged scope) combined with Oracle's 'takeover' phrasing is consistent with an authentication bypass or unauthenticated remote code execution class flaw rather than a single-impact disclosure. The CPE 'cpe:2.3:a:oracle_corporation:siebel_crm_cloud_applications:*' covers the entire product line with no version segmentation, indicating Oracle is treating all supported releases as in-scope.

RemediationAI

Apply the fixes bundled in the Oracle Critical Security Patch Update of June 2026 documented at https://www.oracle.com/security-alerts/cspujun2026.html - patch available per vendor advisory, though an exact fixed build number was not provided in the input data. Until the CPU is deployed, restrict network reachability of the Siebel Cloud Manager HTTP endpoints to trusted management networks and VPN-only access, place a WAF or reverse proxy with strict allow-listing in front of any internet-exposed Siebel Cloud Manager interfaces, and increase monitoring of Siebel administrative and provisioning endpoints for anomalous unauthenticated POST traffic. Note that network restrictions may break legitimate cloud orchestration workflows and tenant self-service flows, so coordinate with Siebel administrators before enforcing.