CVE-2026-46926 is a vulnerability in Oracle Siebel CRM Cloud Applications, specifically in the Siebel Cloud Manager component, affecting version 17.0. It allows a low privileged attacker with logon access to the infrastructure hosting the application to compromise the Siebel CRM Cloud Applications, potentially leading to full takeover. The vulnerability also has scope change implications, potentially impacting other products. The CVSS 3.1 score is 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting high impact on confidentiality, integrity, and availability. The vulnerability is included in Oracle's June 2026 Critical Security Patch Update advisory, which contains multiple patches across Oracle products. However, the advisory content does not explicitly confirm the availability of a patch or fix specifically for Siebel CRM Cloud Applications version 17.0. Oracle recommends applying patches promptly and considering mitigations such as blocking required network protocols and removing unnecessary privileges until patches are applied.

Successful exploitation of this vulnerability can result in complete takeover of the Siebel CRM Cloud Applications, with high impact on confidentiality, integrity, and availability of the affected system. The vulnerability also has a scope change, meaning attacks may significantly affect additional Oracle products beyond Siebel CRM Cloud Applications. The attacker requires low privileges and logon access to the infrastructure, making it easily exploitable under those conditions.

Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among many others and strongly recommends that customers apply the available security patches without delay. Although the advisory does not explicitly confirm a specific patch for Siebel CRM Cloud Applications version 17.0, applying the June 2026 Critical Security Patch Update is advised. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation and removing unnecessary privileges or access to packages from users who do not need them. These mitigations may impact application functionality, so they should be applied cautiously. Customers should monitor Oracle's advisory page for updates on patch availability and installation instructions.