CVE-2026-46889 is a critical vulnerability in Oracle Siebel Apps - Marketing (component: Marketing) affecting supported versions 17.0 through 26.5. It allows an unauthenticated attacker with network access via HTTP to compromise the application, potentially resulting in full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction, and impacts confidentiality, integrity, and availability severely. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability. The vendor strongly recommends applying these patches without delay. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but could disrupt application functionality.

The vulnerability enables unauthenticated remote attackers to fully compromise Oracle Siebel Apps - Marketing, impacting confidentiality, integrity, and availability. This could lead to complete takeover of the affected application, allowing attackers to access sensitive data, modify or delete information, and disrupt service availability.

Oracle has released a Critical Security Patch Update in June 2026 that addresses CVE-2026-46889. Customers should apply these security patches as soon as possible. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, but these measures may affect application functionality. Oracle strongly recommends remaining on actively supported versions and applying patches promptly. Patch status is confirmed by the vendor advisory.