CVE-2026-46884: Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing)

Synopsis

This is an unauthenticated remote compromise vulnerability in the Marketing component of Oracle Siebel CRM (Siebel Apps - Marketing), affecting versions 17.0 through 26.5. The vulnerability is reachable over the network via HTTP with no authentication and no user interaction required, making it trivially exploitable from any network-adjacent position. Successful exploitation results in full takeover of the affected Siebel Apps - Marketing instance, including complete loss of confidentiality, integrity, and availability. No fix versions have been published by Oracle; HarborGuard is tracking the advisory and will make a patched rebuild available the moment upstream publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Siebel Apps - Marketing service over the network via HTTP; no local access or physical proximity is needed.

• AuthenticationNot required

  No credentials of any privilege level are required; the attacker can interact with the vulnerable endpoint as an anonymous user.

• Victim interactionNot required

  Exploitation is entirely attacker-driven and requires no action from any user of the affected system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other unpredictable environmental factors.

Blast Radius

• A successful attacker reads all data accessible to the Siebel Apps - Marketing component, including campaign records, customer contact data, and stored credentials or session tokens.
• The attacker can modify or delete persisted marketing data, campaign configurations, and associated database records.
• The attacker can crash or render the Siebel Apps - Marketing service completely unavailable to legitimate users.
• Full application takeover means the attacker can pivot further into backend systems or infrastructure reachable from the compromised Siebel instance.