CVE-2026-46926 is a vulnerability in Oracle Siebel CRM Cloud Applications, specifically in the Siebel Cloud Manager component. It affects supported versions from 17.0 to 26.5. The vulnerability is easily exploitable by an attacker with low privileges who has logon access to the infrastructure where the application runs. Successful exploitation can lead to complete compromise and takeover of the Siebel CRM Cloud Applications. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability, with attack vector local, low attack complexity, low privileges required, no user interaction, and scope change. Oracle’s June 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly state a dedicated patch or remediation level for this specific issue. Oracle strongly recommends applying security patches promptly and maintaining supported versions.

The vulnerability allows an attacker with low privileges and logon access to the hosting infrastructure to fully compromise Siebel CRM Cloud Applications, resulting in complete takeover. This includes high impact on confidentiality, integrity, and availability of the affected system. The scope change indicates that exploitation may also affect additional Oracle products beyond Siebel CRM Cloud Applications.

Oracle’s June 2026 Critical Security Patch Update advisory includes this vulnerability but does not explicitly confirm patch availability or remediation status for Siebel CRM Cloud Applications. Customers should monitor the referenced Oracle advisory for updates on patch availability. Oracle strongly recommends applying Critical Security Patch Updates promptly and remaining on actively supported versions. Until patches are applied, risk may be reduced by restricting logon access to the infrastructure hosting Siebel CRM Cloud Applications and removing unnecessary privileges from users. These mitigations may impact functionality and should be applied cautiously.