CVE-2026-46884

Unauthenticated HTTP Attack Allows Full Compromise of Oracle Siebel Marketing

View on CVE.org
Published Jun 16, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in takeover of Siebel Apps - Marketing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Analysis

AI-generated

Technical impact

An unauthenticated attacker can exploit a flaw in the Siebel Apps - Marketing component of Oracle Siebel CRM, involving CWE‑284 (Improper Access Control), to execute arbitrary code and take full control of the application. The vulnerability results in complete loss of confidentiality, integrity, and availability, with a CVSS 3.1 base score of 9.8 indicating Critical severity.

Affected Systems

Oracle Corporation’s Siebel Apps - Marketing, versions 17.0 through 26.5, are affected. No other products or versions are listed as vulnerable.

Risk and Exploitability

The low EPSS score (< 1%) suggests that exploitation attempts are currently rare, but the high CVSS score and the ability to achieve takeover without authentication make this a severe danger. The attack vector is inferred to be a network‑based HTTP request, and the vulnerability grants control over the target system without any user interaction.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle security patch for Siebel Apps - Marketing that removes or mitigates the unauthenticated execution flaw
  • Restrict HTTP access to the Siebel Apps - Marketing server to trusted IP addresses or a secure VPN before patches can be applied
  • Disable or isolate the Marketing component if it is not required for business operations, until a patch is available

Generated by OpenCVE AI on June 18, 2026 at 23:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Unauthenticated HTTP Attack Allows Full Compromise of Oracle Siebel Marketing
Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle Siebel Apps Marketing
Weaknesses CWE-94
Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle Siebel Apps Marketing
Weaknesses CWE-284
CWE-94
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in takeover of Siebel Apps - Marketing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle siebel Apps - Marketing
CPEs cpe:2.3:a:oracle:siebel_apps_-_marketing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle siebel Apps - Marketing
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
oracle
Published
Updated
Jun 18, 2026, 3:56 AM
Reserved
May 18, 2026, 3:55 PM

View source JSON

Updated
Jun 17, 2026, 3:41 PM

JSON

Status
Analyzed
Published
Jun 17, 2026, 10:54 AM
Modified
Oct 25, 2026, 11:10 PM

View source JSON

No data.

Updated
Jun 18, 2026, 11:45 PM

JSON