Description
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Mobile Field Service executes to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Service Compromise
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the Oracle Mobile Field Service component of Oracle E‑Business Suite, allowing an attacker who already has high privileged access to the infrastructure where the service runs to compromise Oracle Mobile Field Service. Successful exploitation can lead to a full takeover of the service, affecting confidentiality, integrity, and availability as reflected by the CVSS base score of 6.7 and the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. This is an access control weakness due to improper configuration (CWE-284, CWE-264).

Affected Systems

Oracle Mobile Field Service, versions 12.2.3 through 12.2.15, are the only identified affected releases.

Risk and Exploitability

The CVSS score indicates moderate to high severity, but the attack requires local privileged access, meaning the vulnerability is not remotely exploitable. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog, suggesting limited known exploitation. Nevertheless, if local privileged credentials are compromised, the attacker can gain complete control of the service, so the risk is significant in environments where privileged accounts are not tightly controlled.

Generated by OpenCVE AI on October 21, 2026 at 04:15 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch addressed in the CPU Oct 2026 security update for Oracle Mobile Field Service.
  • If a patch is not yet available, isolate the service from the rest of the infrastructure and restrict administration to only essential, trusted personnel.
  • Enable and review logging and monitoring of authentication and activity on the Oracle Mobile Field Service to detect any abnormal behavior.

Generated by OpenCVE AI on October 21, 2026 at 04:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
Title Local Service Takeover in Oracle Mobile Field Service Allowing Full Compromise
Weaknesses CWE-264
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Mobile Field Service executes to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle mobile Field Service
CPEs cpe:2.3:a:oracle:mobile_field_service:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mobile Field Service
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Mobile Field Service
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T21:07:31.825Z

Reserved: 2026-09-28T15:40:09.499Z

Link: CVE-2026-101674

cve-icon Vulnrichment

Updated: 2026-10-21T19:06:56.330Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:21.780

Modified: 2026-10-21T21:17:35.180

Link: CVE-2026-101674

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:15:07Z

Weaknesses