CVE-2026-46926

Published Jun 16, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Analysis

Technical impact

This vulnerability resides in the Siebel Cloud Manager component of Oracle’s Siebel CRM Cloud Applications (CWE-284: Incorrect Privilege Management). It permits a low‑privileged user who is already logged onto the infrastructure hosting the application to compromise the application, potentially leading to full takeover. The flaw results in complete loss of confidentiality, integrity, and availability for the CRM data and services.

Affected Systems

Oracle Siebel CRM Cloud Applications versions 17.0 through 26.5 are affected. The vulnerability applies to the Siebel Cloud Manager component in all listed releases.

Risk and Exploitability

With a CVSS v3.1 base score of 8.8, the flaw is considered high severity. The EPSS score is less than 1 of exploitation at present, and the issue is not in CISA’s KEV catalog. Attackers would need local access and low privileges to exploit the flaw; however, the change in scope makes damage potentially far greater than the original product alone.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Siebel CRM Cloud Applications

affected

Version	Status	Constraints
`17.0`	affected	≤ 26.5

Configuration 1 [-]

cpe:2.3:a:oracle:siebel_crm:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Siebel Crm Cloud Applications

Version	Status	Scheme	Platform
`[17.0,26.5]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Oracle security patch for Siebel CRM Cloud Applications, ensuring the version is greater than 26.5.
Restrict local user accounts on the servers that host Siebel CRM Cloud Applications to the minimum permissions required for their duties.
Implement network segmentation and firewall rules to isolate the CRM infrastructure and limit lateral movement from compromised hosts.

Generated by OpenCVE AI on June 19, 2026 at 00:06 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.120% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cspujun2026.html

History

Jun 18, 2026 10:00 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Local Privilege Escalation in Oracle Siebel CRM Cloud Applications Enables System Takeover
Weaknesses	CWE-269 CWE-285

Jun 18, 2026 4:45 AM Title updated. Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		Local Privilege Escalation in Oracle Siebel CRM Cloud Applications Enables System Takeover
Weaknesses		CWE-269 CWE-284 CWE-285
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 16, 2026 8:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared		Oracle Oracle siebel Crm Cloud Applications
CPEs		cpe:2.3:a:oracle:siebel_crm_cloud_applications::::::::
Vendors & Products		Oracle Oracle siebel Crm Cloud Applications
References		https://www.oracle.com/security-alerts/cspujun2026.html
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`