CVE-2026-46888

Analyzed Analyzed - Analysis Complete

Siebel CRM Deployment Privilege Escalation Vulnerability

Publication date: 2026-06-17

Last updated on: 2026-06-26

Assigner: Oracle

Description

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Database Upgrade). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-17

Last Modified

2026-06-26

Generated

2026-07-08

AI Q&A

2026-06-17

EPSS Evaluated

2026-07-06

NVD

CVE-2026-46888

EUVD

EUVD-2026-37380

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	siebel_crm	From 17.0 (inc) to 26.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Siebel CRM Deployment product of Oracle Siebel CRM, specifically in the Database Upgrade component. It affects supported versions from 17.0 to 26.5. The vulnerability is easily exploitable by a low privileged attacker who has logon access to the infrastructure where Siebel CRM Deployment runs.

If successfully exploited, the attacker can compromise the Siebel CRM Deployment, potentially taking full control over it.

Impact Analysis

The impact of this vulnerability includes a complete takeover of the Siebel CRM Deployment system by an attacker with low privileges.

Confidentiality impact: High
Integrity impact: High
Availability impact: High

This means sensitive data could be exposed or altered, and the availability of the system could be disrupted.

Compliance Impact

This vulnerability in Oracle Siebel CRM Deployment allows a low privileged attacker to compromise the system, potentially resulting in a takeover. Given the high impact on confidentiality, integrity, and availability (CVSS score 7.8), successful exploitation could lead to unauthorized access to sensitive data.

Such unauthorized access and system compromise could negatively affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data, maintaining data integrity, and ensuring system availability.

Hi! I’m here to help you understand CVE-2026-46888. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70