This vulnerability (CVE-2026-46919) affects Oracle Siebel CRM Cloud Applications, specifically the Siebel Cloud Manager component, in versions 17.0 through 26.5. It is an easily exploitable, unauthenticated network vulnerability accessible via HTTP that can lead to full compromise and takeover of the affected application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 patches and strongly recommends immediate application of these patches to mitigate the risk. No direct patch link or fixed version is explicitly provided in the advisory content, so patch status should be confirmed by consulting the official Oracle advisory.

Successful exploitation allows an unauthenticated attacker with network access via HTTP to fully compromise the Siebel CRM Cloud Applications, resulting in complete takeover. This impacts confidentiality, integrity, and availability of the application, potentially exposing sensitive data, allowing unauthorized modifications, and disrupting service.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users. However, these mitigations may affect application functionality. Patch status is not explicitly confirmed in the advisory content; users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.