Description
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Modification and Access
Action: Immediate Patch
AI Analysis

Impact

A vulnerability exists in the Admin UI component of Oracle Mobile Field Service that permits unauthenticated users to create, delete, or modify critical data or gain full access to all data stored by the application. The flaw has a CVSS v3.1 base score of 7.4, indicating high confidentiality and integrity impact while availability is not affected. The vulnerability is present in the network-facing HTTP, with changes made possible without authentication.

Affected Systems

Oracle Corporation's Oracle Mobile Field Service, component Admin UI, is affected for all supported releases from 12.2.3 through 12.2.15. The vulnerability is present in the network-facing HTTP, with changes made possible without authentication.

Risk and Exploitability

The CVSS score of 7.4 places the vulnerability in a high severity band. The EPSS score is unavailable, but the vulnerability is not listed in CISA KEV, implying no current documented exploitation. The likely attack vector is remote network access via HTTP to the Mobile Field Service Admin UI, and although exploitation is described as difficult, an unauthenticated attacker can compromise data integrity and confidentiality if the flaw is leveraged.

Generated by OpenCVE AI on October 21, 2026 at 06:04 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict network exposure of the Mobile Field Service Admin UI to trusted IP ranges or via a VPN gateway.
  • Apply any available Oracle security patches or updates for Oracle Mobile Field Service when released.
  • Monitor application logs and audit trails for abnormal data creation, modification, or deletion activity and investigate anomalies promptly.

Generated by OpenCVE AI on October 21, 2026 at 06:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via HTTP in Oracle Mobile Field Service Admin UI
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle mobile Field Service
CPEs cpe:2.3:a:oracle:mobile_field_service:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mobile Field Service
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Mobile Field Service
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T18:35:29.635Z

Reserved: 2026-09-28T15:40:09.496Z

Link: CVE-2026-101636

cve-icon Vulnrichment

Updated: 2026-10-21T16:21:58.466Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:17.760

Modified: 2026-10-21T19:16:52.263

Link: CVE-2026-101636

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:15:12Z

Weaknesses