Description
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote compromise via low‑privilege HTTP attack
Action: Immediate Patch
AI Analysis

Impact

A flaw exists in the Admin UI of Oracle Mobile Field Service within Oracle E‑Business Suite that can be exploited by an attacker with low privileges and network access over HTTP. Successful exploitation enables a full takeover of the application, exposing confidential data, allowing modification of system state, and potentially disrupting service availability.

Affected Systems

Oracle Mobile Field Service (part of Oracle E‑Business Suite) versions 12.2.3 through 12.2.15 are affected. Only these deployments are susceptible to the vulnerability.

Risk and Exploitability

The CVSS v3.1 base score of 8.8 indicates high severity, with significant confidentiality, integrity, and availability risks. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is network‑based via HTTP, requiring minimal attack complexity and low privileges, which makes the vulnerability readily exploitable from the network boundary.

Generated by OpenCVE AI on October 21, 2026 at 01:10 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest Oracle Mobile Field Service patch or upgrade to a version that contains the fix
  • Restrict network access to the Admin UI by configuring firewall rules or a VPN so only trusted IP ranges can reach the endpoint
  • Apply least‑privilege access controls for all accounts interacting with the Admin UI and enforce role‑based restrictions

Generated by OpenCVE AI on October 21, 2026 at 01:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Title Remote Exploitation via Low‑Privilege HTTP Attack Enables Full Compromise of Oracle Mobile Field Service
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle mobile Field Service
CPEs cpe:2.3:a:oracle:mobile_field_service:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mobile Field Service
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Mobile Field Service
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-24T03:55:41.588Z

Reserved: 2026-09-28T15:40:09.500Z

Link: CVE-2026-101692

cve-icon Vulnrichment

Updated: 2026-10-22T15:11:33.306Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:23.720

Modified: 2026-10-24T04:18:14.433

Link: CVE-2026-101692

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T22:45:13Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control