Description
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 7.4 High
EPSS: n/a
KEV: No
Impact: Unauthorized data modification and access in Oracle Mobile Field Service via unauthenticated HTTP access
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in the Admin UI of Oracle Mobile Field Service, allowing an unauthenticated attacker with network access over HTTP to create, modify, or delete critical data. This grants full confidentiality and integrity compromise without impacting availability, as reflected by the CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected Systems

Affected systems are Oracle Mobile Field Service versions 12.2.3 through 12.2.15. The product is part of Oracle E‑Business Suite and is provided by Oracle Corporation.

Risk and Exploitability

The CVSS base score of 7.4 indicates high severity, and the EPSS score is not available in the data set, so the likelihood of exploitation is unclear. The vulnerability is not listed in CISA KEV. The likely attack path requires network connectivity to the service’s HTTP port and does not require authentication or special privileges.

Generated by OpenCVE AI on October 21, 2026 at 05:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any Oracle patch or update that addresses the Admin UI vulnerability when it becomes available.
  • Restrict all Admin UI HTTP endpoints so that only authenticated users can access them.
  • Enforce HTTPS for all Oracle Mobile Field Service traffic and ensure HTTP ports are closed or redirected.

Generated by OpenCVE AI on October 21, 2026 at 05:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Modification in Oracle Mobile Field Service
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle mobile Field Service
CPEs cpe:2.3:a:oracle:mobile_field_service:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mobile Field Service
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Mobile Field Service
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:22:10.072Z

Reserved: 2026-09-28T15:40:09.498Z

Link: CVE-2026-101661

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:20.340

Modified: 2026-10-20T22:18:20.340

Link: CVE-2026-101661

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T05:30:13Z

Weaknesses