CVE-2026-46887 Overview
CVE-2026-46887 is a critical access control vulnerability in the Oracle Siebel CRM Siebel Apps - Marketing product. The flaw affects the Marketing component across supported versions 17.0 through 26.5. An unauthenticated attacker with network access over HTTP can exploit the vulnerability without user interaction. Successful exploitation results in full takeover of the Siebel Apps - Marketing application, impacting confidentiality, integrity, and availability. The weakness is classified as Improper Access Control [CWE-284]. Oracle published the advisory in the June 2026 Critical Patch Update.
Critical Impact
Unauthenticated remote attackers can take over Siebel Apps - Marketing over HTTP without user interaction, compromising sensitive marketing and customer data.
Affected Products
- Oracle Siebel CRM - Siebel Apps - Marketing 17.0 through 26.5
- Marketing component of Oracle Siebel CRM
- Deployments exposing Siebel Marketing endpoints over HTTP
Discovery Timeline
- 2026-06-17 - CVE-2026-46887 published to NVD
- 2026-06-18 - Last updated in NVD database
Technical Details for CVE-2026-46887
Vulnerability Analysis
The vulnerability resides in the Marketing component of Oracle Siebel CRM's Siebel Apps - Marketing product. The flaw allows an unauthenticated network attacker to reach functionality that should require authentication and authorization. Because the attack is performed over HTTP and does not require user interaction, it can be automated and conducted at scale against exposed Siebel deployments.
Successful exploitation yields complete compromise of the Marketing application. An attacker gains the ability to read, modify, or destroy data managed by the component and can disrupt service availability. Given Siebel CRM's role in storing customer, campaign, and marketing data, exploitation introduces significant data exposure risk. The EPSS probability is 0.486% with a percentile of 38.027.
Root Cause
The issue is categorized under [CWE-284] Improper Access Control. The Marketing component does not adequately enforce authentication or authorization checks on a network-accessible function path. As a result, requests originating from unauthenticated principals are processed as if they carried valid privileges. Oracle has not published low-level technical detail beyond the June 2026 Critical Patch Update advisory.
Attack Vector
The attack vector is network-based over HTTP. An attacker sends crafted HTTP requests to a reachable Siebel Apps - Marketing endpoint. No credentials, prior foothold, or user interaction are required. Internet-exposed Siebel Marketing instances are at highest risk, but internal exposure remains exploitable by any actor with network reachability to the application tier. Refer to the Oracle Security Alert for vendor guidance.
Detection Methods for CVE-2026-46887
Indicators of Compromise
- Unauthenticated HTTP requests to Siebel Marketing URIs that return successful responses without an associated session
- New or modified marketing campaigns, lists, or templates created outside of normal change windows
- Unexpected administrative actions or data exports originating from the Siebel application tier
- Outbound connections from Siebel application servers to unfamiliar external hosts
Detection Strategies
- Review web server and Siebel application logs for anonymous access to Marketing endpoints and correlate with source IP reputation
- Baseline normal Marketing module usage patterns and alert on deviations such as off-hours activity or unusual user agents
- Inspect HTTP request bodies for parameter tampering or access to functions that should require authentication
Monitoring Recommendations
- Forward Siebel web tier, application server, and database audit logs to a centralized analytics platform for correlation
- Monitor for repeated 200 OK responses on Marketing endpoints from IPs that never authenticate
- Track configuration and data changes within Siebel Marketing objects and alert on anomalous modifications
How to Mitigate CVE-2026-46887
Immediate Actions Required
- Apply the Oracle June 2026 Critical Patch Update fixes for Siebel CRM to all instances running versions 17.0 through 26.5
- Inventory all Siebel Apps - Marketing deployments and confirm patch coverage on each application tier node
- Restrict network reachability to Siebel Marketing endpoints to trusted internal networks and VPNs until patching completes
- Rotate any credentials, API keys, or integration tokens that may have been accessible to the Marketing component
Patch Information
Oracle addressed CVE-2026-46887 in the June 2026 Critical Patch Update. Administrators should review the Oracle Security Alert for fixed version numbers and apply the corresponding Siebel CRM patches. No supported version between 17.0 and 26.5 is exempt prior to patching.
Workarounds
- Place a web application firewall in front of Siebel and block unauthenticated access paths to Marketing URIs
- Remove direct internet exposure of Siebel Marketing and require VPN or zero-trust network access for all users
- Enforce strict allowlists on the reverse proxy or load balancer fronting the Siebel application tier
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
