The Oracle Mobile Field Service product of Oracle E‑Business Suite contains a flaw in its Internal Operations component that allows a high‑privileged attacker who can reach the service over HTTP to compromise it. If exploited, the attacker can take full control of the Mobile Field Service instance, resulting in confidentiality, integrity, and availability compromise. The CVSS 3.1 Base Score is 6.6, reflecting medium severity. This weakness is an instance of improper access control.

Oracle Mobile Field Service, versions 12.2.3 through 12.2.15 are vulnerable. The flaw resides in the Internal Operations component. No other vendors or product versions are listed as impacted.

With a CVSS score of 6.6 the vulnerability is medium severity. The attack vector is network‑based via HTTP, the attack complexity is high, and the required privileges are high, meaning an attacker must already have elevated access to exploit it. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation as of this analysis.