CVE-2026-46921 is a vulnerability in Oracle Siebel CRM Cloud Applications, specifically in the Siebel Cloud Manager component, affecting supported versions 17.0 through 26.5. The flaw allows a low-privileged attacker with network access over HTTP to compromise the application, potentially resulting in complete takeover. The vulnerability is rated with a CVSS 3.1 score of 8.8, reflecting high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 security patches across multiple products. While the advisory does not explicitly confirm a patch for this CVE, Oracle strongly recommends applying the Critical Security Patch Update promptly to address this and other vulnerabilities. Mitigation options prior to patching include blocking attack-related network protocols and removing unnecessary privileges from users, though these may affect application functionality.

Successful exploitation of CVE-2026-46921 can lead to full compromise of Oracle Siebel CRM Cloud Applications, impacting confidentiality, integrity, and availability of the system. An attacker with low privileges and network access via HTTP can leverage this vulnerability to take over the application, potentially leading to unauthorized data access, modification, or service disruption.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users who do not require them. These mitigations may impact application functionality. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest remediation guidance.