CVE-2026-46890: Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing)

Synopsis

An unauthenticated remote exploitation vulnerability affects the Marketing component of Oracle Siebel CRM (versions 17.0 through 26.5). An attacker with HTTP network access can reach the vulnerable component without any credentials or user interaction, and successful exploitation results in full takeover of the Siebel Apps - Marketing application, including read, write, and denial-of-service impact. No fix versions have been published yet; HarborGuard is tracking this advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Siebel Apps - Marketing service over the network via HTTP; there is no local-only restriction.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable endpoint is accessible to unauthenticated requests.

• Victim interactionNot required

  The attacker does not need any user on the target system to take an action; exploitation is fully attacker-driven.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions, special configurations, or environmental factors required.

Blast Radius

• A successful attacker reads all data accessible to the Siebel Apps - Marketing component, including campaign data, contact records, and any credentials or tokens stored by the application.
• A successful attacker writes to or modifies persisted marketing data, campaign configurations, and application state, enabling manipulation of business records.
• A successful attacker crashes or otherwise disrupts the Siebel Apps - Marketing service, making it unavailable to legitimate users.
• Full application takeover means the attacker can chain further access into backend systems or databases that the Marketing component is authorized to reach.