CVE-2026-46890 is a critical vulnerability in Oracle Siebel Apps - Marketing (component: Marketing) affecting versions 17.0 through 26.5. It allows unauthenticated attackers with network access via HTTP to compromise the application fully, leading to complete takeover. The vulnerability is rated with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is remotely exploitable without authentication and results in high confidentiality, integrity, and availability impacts. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Siebel Apps - Marketing, including unauthorized access, data disclosure, data modification, and service disruption. The vulnerability is remotely exploitable over HTTP without any authentication, making it highly critical. The CVSS score of 9.8 reflects the severe impact on confidentiality, integrity, and availability of the affected system.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the June 2026 Critical Security Patch Update promptly to remediate this issue. Until patches are applied, risk may be partially mitigated by blocking network protocols required for exploitation or by restricting privileges and access to sensitive packages for users who do not require them, although these measures may impact application functionality. Oracle recommends remaining on actively supported versions and applying security patches without delay.