CVE-2026-46919
A critical flaw in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager) allows an unauthenticated attacker to take full control of the application over HTTP. The vulnerability affects versions 17.0 through 26.5 and can be exploited from the network without any user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager) versions 17.0‑26.5, used by businesses that rely on Siebel CRM for customer relationship management.
Real-world impact
An attacker who exploits this flaw can read, modify, delete data, and disrupt the entire application, effectively taking over the system.
Why this severity
The CVSS score of 9.8 reflects that the attack is network‑based, requires no authentication or user interaction, and compromises confidentiality, integrity, and availability of the application.
What to do about it
- ›Restrict network access to the Siebel CRM Cloud Applications to trusted IP addresses or VPNs.
- ›Monitor logs for suspicious activity and apply any future patches as soon as they are released.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 17, 2026 · Jun 17, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Aug 3, 2026 · 6h agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- oracle.com/security-alerts/cspujun2026…vendor advisory