Mobile Field Service CVE-2026-101634

No special conditions beyond network reachability - remote unauthenticated exploitation over HTTP against affected Oracle Mobile Field Service instances (Oracle E-Business Suite, Internal Operations component) running versions 12.2.3 through 12.2.15. The CVSS vector (PR:N/UI:N/AC:L) confirms no authentication, no user interaction, and low complexity are required. The primary LIMITING factor is exposure: the Mobile Field Service HTTP endpoint must be reachable by the attacker (internet-facing EBS deployments are far more exposed than internal-only ones), and only the listed 12.2.x versions are affected, so installations outside that range or with the October 2026 CPU applied are not vulnerable. Impact is bounded to confidentiality and availability - there is no integrity/data-modification vector (I:N).

This is a genuine high-priority issue by its inherent characteristics: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, yielding a 9.1 base score driven by complete confidentiality loss (C:H) and full denial of service (A:H), with no integrity impact (I:N). An SSVC-style read of these metrics suggests high automatability (no auth, no UI, simple HTTP) and high technical impact. However, the external corroborating signals that normally elevate priority are ABSENT: no EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced - the only source is Oracle's own October 2026 Critical Patch Update advisory. So while the intrinsic exploitability is severe, there is no evidence of active exploitation or weaponization at this time; the real-world urgency rests on the ease of exploitation and Oracle EBS being a high-value target, not on observed attacks. One tag conflict to verify: the input carries an 'Authentication Bypass' tag, but the description characterizes this as unauthenticated access rather than bypassing an existing auth control - verify the exact mechanism with Oracle before treating it as an auth-bypass class issue.

A remote, unauthenticated attacker sends a crafted HTTP request directly to an internet- or network-reachable Oracle Mobile Field Service instance (Oracle E-Business Suite, Internal Operations component). Because no credentials or user interaction are needed and attack complexity is low, the attacker can read or exfiltrate all data accessible to Mobile Field Service, or repeatedly trigger a hang/crash to take the service fully offline. No public exploit is currently referenced, so exploitation would require the attacker to develop their own request.