CVE-2026-46926: Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager)

Synopsis

A local privilege escalation vulnerability affects the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications, versions 17.0 through 26.5. An attacker with a low-privilege account and local logon access to the infrastructure where the application runs can exploit this without any user interaction. Successful exploitation results in full takeover of Siebel CRM Cloud Applications, with high impact to confidentiality, integrity, and availability, and the scope change means adjacent products on the same infrastructure can also be compromised. No fix versions have been published yet; HarborGuard is tracking this advisory and will surface a patched-image rebuild as soon as upstream releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege account with logon rights to the infrastructure is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No action by another user or administrator is required to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layouts, or environmental prerequisites are needed.

Blast Radius

• A successful attacker gains full control of the Siebel CRM Cloud Applications instance, reading all stored CRM data including customer records, contacts, and sales pipeline information.
• The attacker can modify or delete persisted application data and configuration, corrupting CRM records and business processes.
• The affected service can be crashed or rendered unavailable, disrupting CRM-dependent operations.
• Because the CVSS scope changes, other products and services sharing the same infrastructure can also be compromised beyond the Siebel CRM boundary.