CVE-2026-46885 is a vulnerability in Oracle Siebel CRM Integration (component EAI) affecting supported versions 17.0 through 26.5. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privilege required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level. Oracle recommends applying the Critical Security Patch Update without delay to address this and other vulnerabilities. Workarounds include blocking network protocols required by the attack and removing unnecessary privileges, though these may affect application functionality.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Siebel CRM Integration, impacting confidentiality, integrity, and availability. This can lead to complete takeover of the affected product, posing a critical risk to business operations relying on Siebel CRM Integration.

Oracle's advisory strongly recommends applying the June 2026 Critical Security Patch Update promptly to address this vulnerability along with others. No explicit patch or remediation level is confirmed for this specific CVE in the advisory, so patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing unnecessary privileges from users, though these measures may disrupt application functionality.