Description
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Takeover of Oracle Mobile Field Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in Oracle Mobile Field Service allows a low‑privilege attacker with HTTPS network access to compromise the service, potentially taking full control. Successful exploitation can lead to unauthorized modification, disclosure, or denial of all data and services, affecting confidentiality, integrity, and availability. The CVSS v3.1 vector shows Network attack, Low complexity, Low privilege, no user interaction, Unchanged scope, with high impacts on all CIA triad aspects. The vulnerability involves authorization weaknesses, identified as CWE-284.

Affected Systems

Oracle Corporation’s Oracle Mobile Field Service, component Internal Operations, is affected in all supported releases from 12.2.3 through 12.2.15.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is 0.00447, indicating a low exploitation probability and it is not listed in the CISA KEV catalog. The attack vector is likely remote via the HTTPS interface, requiring only low privileges, which makes it broadly exploitable on accessible networks.

Generated by OpenCVE AI on October 22, 2026 at 11:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest security patch for Oracle Mobile Field Service as released in the Oracle security alert for all affected versions 12.2.3‑12.2.15.
  • Restrict network access to the Oracle Mobile Field Service HTTPS endpoint to trusted IP ranges and implement network segmentation.
  • Disable any unused or legacy APIs and services within the Mobile Field Service that may expose the vulnerable functionality.

Generated by OpenCVE AI on October 22, 2026 at 11:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Title Oracle Mobile Field Service Remote Takeover via Low-Privilege HTTPS Access

Thu, 22 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Remote Exploitation in Oracle Mobile Field Service Allows Low Privilege Takeover
Weaknesses CWE-285

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
Title Remote Exploitation in Oracle Mobile Field Service Allows Low Privilege Takeover
Weaknesses CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle mobile Field Service
CPEs cpe:2.3:a:oracle:mobile_field_service:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mobile Field Service
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Mobile Field Service
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-24T03:55:46.766Z

Reserved: 2026-09-28T15:40:09.498Z

Link: CVE-2026-101656

cve-icon Vulnrichment

Updated: 2026-10-21T16:22:21.933Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:19.963

Modified: 2026-10-24T04:18:12.877

Link: CVE-2026-101656

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:00:14Z

Weaknesses