CVE-2026-46919: Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager)

Synopsis

An authentication bypass (or equivalent unauthenticated remote attack) vulnerability exists in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications, affecting versions 17.0 through 26.5. The vulnerability is reachable over the network via HTTP and requires no authentication and no user interaction. Successful exploitation results in full takeover of the Siebel CRM Cloud Applications instance, giving an attacker control over confidentiality, integrity, and availability. No fix version has been published by Oracle; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Siebel Cloud Manager HTTP service over the network; no local or physical access is required.

• AuthenticationNot required

  No credentials are needed; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionNot required

  No user action or social engineering is required; the attacker acts entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker reads all data accessible to the Siebel CRM Cloud Applications instance, including CRM records, customer data, and stored credentials.
• A successful attacker writes or modifies persisted CRM data, configurations, and application state within the compromised instance.
• A successful attacker can crash or render the Siebel CRM Cloud Applications service unavailable, disrupting business operations that depend on it.
• Full application takeover gives the attacker a foothold to pivot to adjacent services or infrastructure reachable from the Siebel Cloud Manager host.