CVE-2026-46887: Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing)

Synopsis

This is a critical-severity vulnerability in the Marketing component of Oracle Siebel CRM (versions 17.0 through 26.5). An unauthenticated attacker with network access over HTTP can reach the affected component without any special privileges or victim interaction, making it trivially reachable from the internet or internal networks. Successful exploitation results in full takeover of the Siebel Apps - Marketing instance, giving the attacker control over its confidentiality, integrity, and availability. No fix versions have been published by Oracle; HarborGuard is tracking this advisory and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Siebel Apps - Marketing service over the network via HTTP; no local or physical access is required, meaning internet- or intranet-exposed deployments are directly at risk.

• AuthenticationNot required

  No account or credential of any kind is needed; the attacker can send malicious requests to the service as an anonymous user.

• Victim interactionNot required

  No user action, click, or session is required on the part of anyone running or using the affected system.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special timing, race condition, or environmental setup to succeed.

Blast Radius

• The attacker reads all data accessible to the Siebel Marketing component, including campaign records, contact lists, and any credentials or tokens stored in the application.
• The attacker writes or modifies persisted marketing data, campaign configurations, and application state, enabling data manipulation or poisoning.
• The attacker can crash or render the Siebel Apps - Marketing service unavailable, disrupting campaign operations and dependent workflows.
• Full application takeover means the attacker can establish persistence, pivot to connected backend systems, or exfiltrate the entire data set managed by the component.