CVE-2026-46887 is a critical vulnerability in Oracle Siebel Apps - Marketing (component: Marketing) affecting supported versions from 17.0 to 26.5. It allows an unauthenticated attacker with network access via HTTP to compromise the application, potentially leading to full takeover. The vulnerability is scored 9.8 on the CVSS 3.1 scale with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. Oracle has published this vulnerability as part of its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple products. Oracle strongly recommends applying these patches immediately. The vendor advisory does not specify a separate patch for this CVE but indicates that the Critical Security Patch Update addresses it. Temporary mitigations include blocking network protocols required for exploitation and removing unnecessary privileges, though these may disrupt normal operations.

Successful exploitation of this vulnerability allows an unauthenticated attacker to fully compromise Oracle Siebel Apps - Marketing, resulting in complete loss of confidentiality, integrity, and availability of the affected application. This can lead to total takeover of the marketing application component, potentially impacting business operations and sensitive data managed by the product.

Oracle has included this vulnerability in its June 2026 Critical Security Patch Update. Customers should apply this security patch update as soon as possible to remediate the vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and by removing unnecessary privileges from users who do not need them; however, these workarounds may affect application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the June 2026 Critical Security Patch Update advisory.