What is the CVSS score of EUVD-2026-46523?

EUVD-2026-46523 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Siebel CRM are affected by EUVD-2026-46523?

Oracle Siebel CRM instances running versions 17.0-26.3 are subject to unauthenticated remote takeover through the Approval Manager component, enabling complete system compromise without credentials…

How to fix or mitigate EUVD-2026-46523?

Within 24 hours: conduct a complete inventory of all Oracle Siebel CRM deployments (production, development, testing) identifying versions and documenting business criticality and network accessibility. Within 7 days: enforce network-level access restrictions via firewall rules limiting HTTP/HTTPS traffic to Siebel CRM to whitelisted business users and systems only; deploy web application firewall signatures to block suspicious HTTP patterns; enable comprehensive logging of all Siebel network activity for threat detection. Within 30 days: subscribe to Oracle security bulletins and monitor for CVE-2026-47036 patch release; prepare and test patch deployment procedures in non-production environments; execute vendor patch to all affected systems within 72 hours of availability.

Oracle Siebel CRM EUVD-2026-46523

| CVE-2026-47036 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-gfcm-5mp4-vvxw

Authentication Bypass Oracle Siebel Crm Development Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes unauthenticated HTTP-based takeover with no user interaction, giving AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H; scope unchanged as the Siebel component is itself the impacted system.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:26 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager). Supported versions that are affected are 17.0-26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development. Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Siebel CRM (Siebel CRM Development, Siebel Approval Manager component) is possible by an unauthenticated attacker sending crafted HTTP requests, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, affecting supported versions 17.0 through 26.3. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list, but the unauthenticated network-facing profile makes it a high-priority patch item.

Technical ContextAI

Oracle Siebel CRM is a large enterprise customer relationship management suite; the affected element is the Siebel Approval Manager component within the Siebel CRM Development product, reachable over HTTP as part of the Siebel web/application server tier. Oracle does not publish a CWE for this entry (CWE listed as N/A) and provides no technical root-cause detail beyond the CVSS vector, which is typical of Oracle Critical Patch Update advisories. Because the CVSS scope is Unchanged (S:U) yet impact is complete across C/I/A, the vulnerable component and the impacted component are the same, consistent with a flaw in the HTTP-facing Siebel application logic that grants attacker control of the Siebel CRM Development instance itself. The affected product is identified by CPE cpe:2.3:a:oracle_corporation:siebel_crm_development:*.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory; Oracle does not publish a discrete fixed-version string in the supplied data, so obtain the applicable patch for your Siebel release from https://www.oracle.com/security-alerts/cpujul2026.html and Oracle Support). Because exploitation is unauthenticated over HTTP, until patching is complete restrict network reachability of the Siebel application/web tier - place it behind a VPN or restrict source IPs, and use a WAF or reverse proxy to filter and rate-limit access to the Siebel Approval Manager endpoints; the trade-off is that legitimate remote or partner access to Siebel may be disrupted and must be allowlisted. Increase logging and monitoring of the Siebel HTTP tier for anomalous requests as a detective control. Do not rely on network controls alone as a permanent substitute for the Oracle patch.