This vulnerability (CVE-2026-46925) affects Oracle Siebel CRM Cloud Applications, specifically the Siebel Cloud Manager component, in version 17.0. It is difficult to exploit and requires the attacker to have access to the physical communication segment connected to the hardware where the application runs. The vulnerability allows an unauthenticated attacker to compromise the Siebel CRM Cloud Applications, potentially resulting in full takeover and impacting other Oracle products (scope change). The CVSS 3.1 vector indicates attack vector as adjacent network (AV:A), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), and scope change (S:C), with high confidentiality, integrity, and availability impacts (C:H/I:H/A:H). Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 patches but does not specify a direct patch version for Siebel CRM Cloud Applications. Oracle strongly recommends applying the Critical Security Patch Update promptly to mitigate this risk.

Successful exploitation of CVE-2026-46925 can lead to complete takeover of the Siebel CRM Cloud Applications, compromising confidentiality, integrity, and availability of the application. The vulnerability also has a scope change effect, meaning it may significantly impact additional Oracle products beyond Siebel CRM Cloud Applications. The attack requires physical network segment access, making exploitation difficult but impactful if achieved.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which addresses this vulnerability among others. Customers should remain on actively supported versions and apply security patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required by an attack and removing unnecessary privileges or access to packages for users who do not need them. These mitigations may impact application functionality, so careful evaluation is needed. Patch status is not explicitly confirmed for Siebel CRM Cloud Applications in the advisory; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and instructions.