A vulnerability in Oracle Mobile Field Service allows a low privileged attacker with access to the service’s HTTPS interface to compromise the entire application. Successful exploitation results in a full takeover of the platform, enabling an attacker to read, modify, and delete data as well as disrupt service availability. The impact is high across confidentiality, integrity, and availability, as reflected in the CVSS‑3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

The affected product is Oracle Mobile Field Service, part of Oracle E‑Business Suite, with supported versions 12.2.3 through 12.2.15. No other Oracle components are indicated as vulnerable.

The CVSS 3.1 base score of 8.8 indicates a high severity level. The EPSS score is not available, but the lack of a KEV listing does not diminish the risk – the vulnerability is easily exploitable by an attacker who can reach the service over HTTPS. A likely attack vector is a network‑based exploit originating from an attacker with low privileges on the network, exploiting insufficient access control to assume full control of the application.