A flaw in the Admin UI of Oracle Mobile Field Service allows an attacker who has only low privileges and can reach the system over HTTP to create, delete or alter data, and to read data that should be protected. The vulnerability can be exercised easily, causing significant losses of confidentiality and integrity for business information. The description does not indicate a denial of service or remote code execution, but the impact on data access and alteration is severe.

Oracle Mobile Field Service, part of Oracle E‑Business Suite, has a range of affected releases from 12.2.3 to 12.2.15. No specific sub‑component IDs are listed; the entire Admin UI is impacted.

The CVSS score of 8.1 marks this as a high‑severity issue, and the attack vector is network‑based (HTTP) with a low effort and low privilege. While no EPSS score is published for this item and it is not currently in the CISA KEV catalog, the combination of a direct network entry point and the ability to modify critical data means the risk is still high. In practice, a low‑privileged attacker could exploit the flaw to gain full access to all data exposed by the product.