CVE-2026-46884 is a critical, easily exploitable vulnerability in Oracle Siebel Apps - Marketing (version 17.0) that allows unauthenticated remote attackers with network access via HTTP to take over the application. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 security patches but does not explicitly state the exact patch version for Siebel Apps - Marketing. Oracle strongly recommends applying the Critical Security Patch Update promptly to mitigate this and other vulnerabilities. Until patches are applied, risk reduction may be achieved by blocking required network protocols and limiting user privileges, though these measures may disrupt normal application operations.

Successful exploitation of CVE-2026-46884 results in complete compromise of Oracle Siebel Apps - Marketing, affecting confidentiality, integrity, and availability. An unauthenticated attacker with network access via HTTP can take over the application, potentially leading to unauthorized data access, modification, and service disruption.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to remediate this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users. These mitigations may impact application functionality. Patch status is not explicitly confirmed in the advisory; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.