What is the CVSS score of EUVD-2026-37376?

EUVD-2026-37376 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Siebel CRM are affected by EUVD-2026-37376?

Oracle Siebel Apps - Marketing (versions 17.0-26.5) contains a critical vulnerability enabling remote, unauthenticated attackers to completely compromise the marketing system.

How to fix or mitigate EUVD-2026-37376?

Within 24 hours: Identify and inventory all systems running Oracle Siebel Apps - Marketing versions 17.0-26.5; document network exposure, internet connectivity, and business criticality for each instance. Within 7 days: Implement network segmentation to restrict direct access to affected instances; enable detailed logging and SIEM integration for monitoring suspicious access patterns and attempted exploitation. Within 30 days: Actively monitor Oracle security advisories for patch release; prepare a tested deployment plan to apply the patch immediately upon vendor release; evaluate business continuity and alternative platform options if patch timeline exceeds risk tolerance.

Oracle Siebel CRM EUVD-2026-37376

| CVE-2026-46884 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Siebel Apps Marketing Authentication Bypass

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description states easily exploitable, unauthenticated, HTTP-reachable, resulting in full component takeover - supports AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:29 vuln.today

DescriptionCVE.org

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in takeover of Siebel Apps - Marketing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote unauthenticated takeover of Oracle Siebel Apps - Marketing (versions 17.0 through 26.5) is possible over HTTP, requiring no privileges or user interaction. Successful exploitation yields full compromise of the Marketing component with high confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Siebel Apps - Marketing is the campaign management module of Oracle's Siebel CRM suite, used by enterprises to design, execute, and track multi-channel marketing campaigns. The CPE 'cpe:2.3:a:oracle_corporation:siebel_apps_-_marketing' confirms the affected component is the Marketing application itself rather than a shared infrastructure layer. Oracle has not published a CWE classification, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) combined with 'takeover' language is consistent with a pre-authentication flaw in an internet-reachable HTTP endpoint - typically arising from authentication bypass, deserialization, injection, or broken access control in the web tier.

RemediationAI

Patch available per vendor advisory: apply the fixes shipped in Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) - Oracle does not publish discrete fix version strings in CPU listings, so consult the advisory matrix for the exact post-CPU patch level matching your Siebel release. Until the CPU can be applied, restrict network reachability of the Siebel Apps - Marketing HTTP endpoints to trusted internal management networks via firewall or reverse-proxy ACLs (side effect: legitimate remote marketing users will lose access), and place a WAF in front of the Marketing servlet paths to block anomalous unauthenticated POST/GET traffic (side effect: potential false positives on campaign-import workflows). Increase logging on the Marketing web tier and monitor for unauthenticated requests reaching administrative or campaign-execution URLs.