The Oracle Mobile Field Service component of Oracle E‑Business Suite suffers from a local privilege escalation flaw. A user who has high‑privileged access to the host where the service runs can exploit the vulnerability and fully compromise the application. This results in loss of confidentiality, integrity and availability of all data and services managed by Oracle Mobile Field Service. The weakness corresponds to CWE‑269: Privilege Escalation and CWE‑284: Improper Access Control.

Oracle Mobile Field Service versions 12.2.3 through 12.2.15 are affected. These releases are part of the Oracle E‑Business Suite product family. Only installations of these specific release branches are impacted by the flaw.

The CVSS 3.1 base score of 6.7 reflects a medium severity risk. Exploitation is local (AV:L) with low complexity and requires high privileges (PR:H). The vulnerability is not listed in CISA KEV and has an EPSS score of < 1%. The likely attack vector is a local administrator or other user with elevated privileges on the underlying infrastructure; based on the description, it is inferred that an attacker must already be authenticated on the host to leverage the flaw.