This vulnerability (CVE-2026-46920) affects Oracle Siebel CRM Cloud Applications versions 17.0 through 26.5, specifically the Siebel Cloud Manager component. It allows an unauthenticated attacker with network access via HTTP to compromise the application, potentially leading to full takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 patches and strongly recommends applying the update promptly. No explicit patch version or fix details are provided in the advisory excerpt, and the vendor emphasizes the importance of staying on supported versions and applying patches without delay.

Successful exploitation can result in complete compromise and takeover of Oracle Siebel CRM Cloud Applications, impacting confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely over the network without authentication but is described as difficult to exploit. No known exploits in the wild have been reported at this time.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to vulnerable components, though these measures may impact application functionality. Patch status is not explicitly confirmed in the advisory excerpt; therefore, check the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for current patch availability and detailed remediation instructions.