Description
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 7.4 High
EPSS: n/a
KEV: No
Impact: Remote unauthorized data modification
Action: Upgrade immediately
AI Analysis

Impact

The vulnerability resides in the Admin UI component of Oracle Mobile Field Service. An unauthenticated attacker with network access via HTTP can create, delete, or modify critical data, or gain complete access to all data accessible by the service. The CVSS 3.1 base score of 7.4 reflects significant confidentiality and integrity impacts.

Affected Systems

Oracle Mobile Field Service, versions 12.2.3 through 12.2.15, part of Oracle E‑Business Suite. Versions outside this range are not reported as affected.

Risk and Exploitability

The CVSS score of 7.4 indicates a high severity. EPSS data is not available, and the vulnerability is not in the CISA KEV catalog. Exploitation requires only network access to the Admin UI over HTTP, no credentials, and no user interaction, making it a high‑risk remote attack that can compromise all data accessible through Mobile Field Service.

Generated by OpenCVE AI on October 21, 2026 at 01:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle’s CPU Oct 2026 patch or upgrade to version 12.2.16 or later.
  • Restrict HTTP access to the Admin UI to a trusted IP range or VPN only.
  • Monitor system logs for unauthorized data manipulation attempts.

Generated by OpenCVE AI on October 21, 2026 at 01:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP‑Based Data Modification in Oracle Mobile Field Service
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle mobile Field Service
CPEs cpe:2.3:a:oracle:mobile_field_service:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mobile Field Service
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Mobile Field Service
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:22:09.378Z

Reserved: 2026-09-28T15:40:09.498Z

Link: CVE-2026-101658

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:20.097

Modified: 2026-10-20T22:18:20.097

Link: CVE-2026-101658

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T02:30:13Z

Weaknesses