CVE-2026-46920 is a vulnerability in Oracle Siebel CRM Cloud Applications, specifically the Siebel Cloud Manager component, affecting version 17.0. The vulnerability allows an unauthenticated attacker with network access over HTTP to compromise the application, potentially resulting in full takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector with high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 fixes across multiple products. While the advisory does not explicitly state a fixed version or patch for Siebel CRM Cloud Applications, Oracle strongly recommends applying the Critical Security Patch Update promptly to address this and other vulnerabilities. Workarounds may include blocking network protocols required by the attack or restricting privileges, but these may disrupt application functionality.

Successful exploitation of CVE-2026-46920 can lead to complete compromise of Oracle Siebel CRM Cloud Applications, impacting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via HTTP could take over the application, potentially leading to unauthorized data access, modification, or service disruption.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required by the attack or removing unnecessary privileges from users, though these mitigations may affect application functionality. Patch status is not explicitly confirmed for Siebel CRM Cloud Applications in the advisory; therefore, customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.