Description
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The Oracle Mobile Field Service product is vulnerable to a compromise that allows a low‑privileged attacker with network access over HTTP to gain unauthorized control. Successful exploitation would result in a full takeover, providing the attacker with complete access to the system and compromising confidentiality, integrity, and availability. The vulnerability is classified as High severity with a CVSS 3.1 base score of 8.8.

Affected Systems

Affected systems include Oracle Mobile Field Service within Oracle E‑Business Suite for versions 12.2.3 through 12.2.15. Only these versions are listed as impacted; other editions are not reported.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity threat, and although EPSS data is not available, the lack of a KEV listing does not diminish the risk. An attacker who can reach the service could exploit the flaw quickly, underscoring the need for immediate remediation.

Generated by OpenCVE AI on October 21, 2026 at 05:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle Mobile Field Service security patch from the Oct 2026 update or upgrade to a version newer than 12.2.15 following Oracle’s guidance at the provided security alert.
  • If immediate patching is not feasible, limit HTTP access to the affected service by configuring network firewalls or VPNs to allow only trusted IP ranges.
  • Enforce strong authentication and deny unused low‑privileged accounts for the internal operations component to reduce the attack surface.

Generated by OpenCVE AI on October 21, 2026 at 05:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
Title Low‑privileged HTTP access allows compromise of Oracle Mobile Field Service
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle mobile Field Service
CPEs cpe:2.3:a:oracle:mobile_field_service:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mobile Field Service
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Mobile Field Service
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-24T03:55:42.408Z

Reserved: 2026-09-28T15:40:09.496Z

Link: CVE-2026-101635

cve-icon Vulnrichment

Updated: 2026-10-21T16:21:56.816Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:17.650

Modified: 2026-10-24T04:18:12.240

Link: CVE-2026-101635

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:00:09Z

Weaknesses