This vulnerability (CVE-2026-47036) exists in Oracle Siebel CRM Development's Siebel Approval Manager component and is exploitable remotely without authentication via HTTP. The flaw allows attackers to compromise the system fully, resulting in complete takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can be performed over the network, causing high impact on confidentiality, integrity, and availability. Affected versions explicitly include 17.0, with the description mentioning versions up to 26.3. Oracle's July 2026 Critical Patch Update advisory references numerous patches but does not explicitly confirm patch availability or remediation status for this CVE. No known exploits in the wild have been reported to date.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to take over the Siebel CRM Development system completely. This includes full compromise of confidentiality, integrity, and availability of the affected system, potentially leading to unauthorized data access, modification, and service disruption.

Oracle has released a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities across its product portfolio, including Siebel CRM Development. Although the advisory does not explicitly confirm a patch for CVE-2026-47036, customers are strongly advised to apply the latest Critical Patch Updates from Oracle without delay. Patch status for this specific vulnerability is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the most current remediation guidance.