CVE-2026-73966

CVE-2026-73966 is a vulnerability in the Marketing component of Oracle Siebel Apps within Oracle Siebel CRM, affecting supported versions 17.0 through 26.7. Oracle rates it as easily exploitable by a remote attacker with network access via HTTP who already holds high privileges, meaning an authenticated, admin-level user can trigger the flaw through normal web interactions with the Marketing module. A successful attack results in complete takeover of Siebel Apps – Marketing, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.2). Organizations running Siebel CRM with the Marketing application exposed to broad internal or external networks are the primary concern, since the flaw is contained to that component (scope unchanged). There is no known public proof of concept and the CVE is not on the CISA Known Exploited Vulnerabilities list, so exploitation status is none known.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-73966 to all Siebel CRM deployments in the 17.0–26.7 range running the Marketing application. Because exploitation requires a high-privilege account, audit and least-privilege administrative roles, enforce MFA, and monitor privileged accounts for anomalous activity against Marketing URLs. Restrict HTTP access to the Siebel Marketing module to trusted networks and management segments where possible.