CVE-2026-46886 is a vulnerability in Oracle Siebel Apps - Marketing (component: Marketing) affecting version 17.0. It allows a low privileged attacker with network access via HTTP to compromise the application, potentially leading to full takeover. The CVSS 3.1 base score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability (CVSS vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle has published this vulnerability as part of its June 2026 Critical Security Patch Update and advises customers to apply patches without delay. The vendor advisory does not explicitly state the patch availability for this specific CVE but strongly recommends applying the Critical Security Patch Update to address it. Temporary mitigations include blocking required network protocols and limiting privileges, though these may affect application functionality.

The vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Siebel Apps - Marketing version 17.0. This can result in complete takeover of the affected application component, with high impact on confidentiality, integrity, and availability of the system.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users. However, these mitigations may disrupt application functionality. Patch status is not explicitly confirmed in the advisory; customers should consult the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.