CVE-2026-46886: Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing)

Synopsis

An easily exploitable vulnerability exists in the Marketing component of Oracle Siebel CRM (Siebel Apps - Marketing), affecting versions 17.0 through 26.5. The flaw is reachable over the network via HTTP and requires only a low-privileged account, with no victim interaction needed. Successful exploitation gives an attacker full control over the affected Siebel Apps - Marketing instance, impacting confidentiality, integrity, and availability. No fix versions have been published yet; HarborGuard is tracking the Oracle advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Siebel Apps - Marketing service over the network via HTTP; no local or physical access is assumed.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative credentials.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed for exploitation.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special conditions, race timing, or memory-layout knowledge.

Blast Radius

• A successful attacker reads all data accessible to the Siebel Marketing application, including campaign records, contact lists, and stored credentials.
• The attacker can modify or delete persisted marketing data, campaign configurations, and application settings.
• The attacker can crash or otherwise take over the Siebel Apps - Marketing service, causing a full denial of service for marketing operations.
• Full application takeover means the attacker can pivot using the application's identity and network position to reach adjacent internal services.