Oracle Mobile Field Service is vulnerable to a network‑based flaw that allows an attacker with low privileges to exploit the service over HTTP. Successful exploitation can result in a full takeover of the application, compromising confidentiality, integrity, and availability of the data and processes managed by the product. The flaw enables the attacker to compromise the system without elevated privileges and leads to unauthorized data disclosure, modification, or denial of service.

Oracle Mobile Field Service, part of Oracle E‑Business Suite, is affected in the supported versions from 12.2.3 through 12.2.15. All installations of these versions that expose the service to network traffic are at risk.

The CVSS 3.1 base score of 8.8 denotes a high severity vulnerability. The attack vector is network‑based, the required privileges are low, attack complexity is low, and no user interaction is needed. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. An attacker who can reach the service over HTTP can reliably exploit the flaw, resulting in a complete compromise of the Mobile Field Service instance.