CVE-2026-46885: Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI)

Synopsis

An unspecified vulnerability in the EAI (Enterprise Application Integration) component of Oracle Siebel CRM Integration allows a network-accessible attacker with a low-privilege account to fully compromise the affected system. The attack is carried out over HTTP and requires no victim interaction, making it straightforward to execute against any exposed instance running versions 17.0 through 26.5. Successful exploitation results in complete takeover of the Siebel CRM Integration environment, affecting confidentiality, integrity, and availability. No fix version has been published by Oracle; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as upstream publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Siebel CRM Integration service over the network via HTTP; any internet- or intranet-exposed instance is within scope.

• AuthenticationRequired

  A low-privilege account is sufficient; no administrative or elevated credentials are needed, but the attacker must hold some valid credential on the target system.

• Victim interactionNot required

  The attack completes without any action from a logged-in user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions, race conditions, or configuration prerequisites.

Blast Radius

• A successful attacker reads all data accessible to the EAI component, including CRM records, integration credentials, and session tokens.
• The attacker modifies or deletes persisted data in the Siebel CRM Integration layer, including integration configurations and business object records.
• The attacker crashes or renders the Siebel CRM Integration service unavailable, disrupting connected enterprise application workflows.
• Full takeover of the integration layer gives the attacker a pivot point into backend systems and external endpoints connected via EAI.