CVE-2026-46889 is a critical vulnerability in Oracle Siebel Apps - Marketing (component: Marketing) affecting supported versions 17.0 through 26.5. It allows an unauthenticated attacker with network access via HTTP to compromise the application completely, leading to takeover. The vulnerability is scored 9.8 on the CVSS 3.1 scale with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 security patches but does not explicitly state patch availability or remediation level for this specific issue. Oracle urges customers to apply the Critical Security Patch Update without delay to address this and other vulnerabilities. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but could affect application functionality.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to fully compromise Oracle Siebel Apps - Marketing, resulting in complete takeover of the application. This includes full loss of confidentiality, integrity, and availability of the affected system component.

Oracle's June 2026 Critical Security Patch Update advisory strongly recommends applying the provided security patches as soon as possible to remediate this vulnerability. Although the advisory does not explicitly confirm patch availability for CVE-2026-46889, it is included in the update. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users. However, these mitigations may disrupt normal application functionality. Customers should monitor Oracle's advisory for patch release details and apply updates promptly.