The vulnerability exists in the Oracle Mobile Field Service of Oracle E‑Business Suite and is located in the Internal Operations component. An attacker with low privileges who can reach the system over HTTP can exploit the flaw to compromise the service. Successful exploitation permits full takeover, resulting in loss of confidentiality, integrity, and availability. The weakness stems from improper enforcement of access controls that allow unauthorized actions from a network source. Based on the CVSS vector, the attacker does not need a user interface; the attack is purely remote.

Affected are Oracle Mobile Field Service 12.2.3 through 12.2.15. All builds within that range are impacted, regardless of patch level. Users should verify the exact installed version and ensure that no unsupported or older versions are in use.

The CVSS 3.1 base score of 8.8 indicates a high‑severity vulnerability, and the vector reveals that an attacker only needs low privileges and can act over the network without any user interaction. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog, suggesting limited exploitation in the wild. However, the ability to compromise the service from any network host that can reach its HTTP interface poses a significant risk, especially for organizations that expose the application externally. Rapid patching or mitigation is strongly advised.