CVE-2026-46884 is a critical vulnerability in Oracle Siebel Apps - Marketing (component: Marketing) affecting supported versions 17.0 through 26.5. It allows an unauthenticated attacker with network access via HTTP to compromise the application fully, resulting in takeover. The vulnerability is scored 9.8 on the CVSS 3.1 scale with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes patches addressing this vulnerability. The vendor strongly recommends applying these patches without delay. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but can affect application functionality.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Siebel Apps - Marketing, including full confidentiality, integrity, and availability impacts. An unauthenticated attacker can remotely take over the application via HTTP without any user interaction or privileges. This poses a critical risk to organizations using affected versions, potentially resulting in data breaches, unauthorized control, and service disruption.

Oracle has released a Critical Security Patch Update in June 2026 that includes patches for this vulnerability. Customers should apply these security patches as soon as possible to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users; however, these measures may disrupt application functionality. Oracle strongly recommends staying on actively supported versions and promptly applying security patches. Patch status is confirmed by the vendor advisory linked.