Description
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Confidentiality breach
Action: Immediate Patch
AI Analysis

Impact

Oracle Mobile Field Service’s Admin UI contains a flaw that allows an unauthenticated attacker who can reach the application over HTTP to read all data exposed through the service. The vulnerability exposes critical data without any need for credentials, representing a direct breach of confidentiality and falling under improper access control weaknesses.

Affected Systems

Versions 12.2.3 through 12.2.15 of Oracle Mobile Field Service, part of Oracle E‑Business Suite, are affected. Any deployment that exposes the Admin UI to the network via HTTP is susceptible.

Risk and Exploitability

The flaw carries a CVSS v3.1 base score of 7.5, indicating high severity. An attacker only needs network access to the vulnerable Admin UI and authentication is not required, making exploitation straightforward. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the ease of exploitation and high confidentiality impact elevate the overall risk.

Generated by OpenCVE AI on October 21, 2026 at 04:18 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch or upgrade to version 12.2.16 or newer, which fixes the unauthenticated access flaw.
  • Restrict external HTTP traffic to the Admin UI to trusted hosts only, or enforce VPN and strict access control policies.
  • Enable logging and monitoring for login attempts and unauthorized accesses, and review activity for indicators of compromise.

Generated by OpenCVE AI on October 21, 2026 at 04:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Allows Data Exfiltration in Oracle Mobile Field Service Admin UI
Weaknesses CWE-284
CWE-306

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle mobile Field Service
CPEs cpe:2.3:a:oracle:mobile_field_service:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mobile Field Service
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Mobile Field Service
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:22:09.711Z

Reserved: 2026-09-28T15:40:09.498Z

Link: CVE-2026-101660

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:20.217

Modified: 2026-10-20T22:18:20.217

Link: CVE-2026-101660

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T04:30:14Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-306

    Missing Authentication for Critical Function