Description
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: System Takeover
Action: Immediate Patch
AI Analysis

Impact

The Oracle Mobile Field Service product contains a vulnerability in its Admin UI component that permits a high‑privileged attacker who can reach the service via HTTPS to compromise the system. Exploitation can lead to full takeover, compromising confidentiality, integrity and availability of the application. The flaw is scored as serious, with a CVSS 3.1 base score of 7.2 and a vector indicating network access, low attack complexity, high privileges and no user interaction.

Affected Systems

Oracle Mobile Field Service versions 12.2.3 through 12.2.15 are affected. The flaw resides in the Admin UI component of the product.

Risk and Exploitability

The vulnerability is easily exploitable for anyone who can connect to the Admin UI over HTTPS and already possesses elevated privileges. With these prerequisites, an attacker can gain control of the service, leading to full system compromise. The CVSS score of 7.2 indicates a high risk level. No EPSS score is provided, and the issue is not listed in CISA KEV, suggesting that while it is high risk, public exploitation evidence is limited at this time.

Generated by OpenCVE AI on October 21, 2026 at 03:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch that addresses the Admin UI flaw or upgrade to a version beyond 12.2.15
  • Restrict network access to the Admin UI to trusted IP addresses or VPN endpoints to limit exposure
  • Enforce strict least‑privilege policies for administrative accounts to reduce the likelihood of privilege escalation

Generated by OpenCVE AI on October 21, 2026 at 03:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
Title Admin UI Vulnerability Enables High-Privilege Attackers to Compromise Oracle Mobile Field Service
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle mobile Field Service
CPEs cpe:2.3:a:oracle:mobile_field_service:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mobile Field Service
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Mobile Field Service
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T15:20:28.198Z

Reserved: 2026-09-28T15:40:09.500Z

Link: CVE-2026-101694

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:23.830

Modified: 2026-10-22T16:17:12.057

Link: CVE-2026-101694

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:30:09Z

Weaknesses