Mobile Field Service CVE-2026-101635

Exploitation requires (1) network HTTP access to the Oracle Mobile Field Service application, specifically its Internal Operations component, and (2) a valid low-privileged account on the system (PR:L) - it is NOT anonymous/unauthenticated. Affected deployments are Oracle E-Business Suite Mobile Field Service versions 12.2.3 through 12.2.15; systems outside this range or already patched via Oracle CPU October 2026 are not exposed. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once an attacker holds any low-privileged credential and can reach the HTTP endpoint, no further special configuration is described as necessary. The primary limiting factor is the authentication requirement; the scope is unchanged (S:U), so impact is confined to the Mobile Field Service component itself rather than cascading to separate systems.

This is a genuine high-priority vulnerability by composite signal, though not yet a confirmed in-the-wild threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only a low-privileged authenticated account and no user interaction, yielding full C:H/I:H/A:H impact and vendor-described 'takeover' - an 8.8 that is realistically achievable rather than theoretical. However, several real-risk modifiers are ABSENT from the input and must not be fabricated: no EPSS score is provided, so exploitation probability cannot be quantified; CISA KEV status is not indicated (treat as not listed), so there is no confirmation of active exploitation; and no public POC is referenced. The one friction point is PR:L - an attacker needs a valid (even if low-privileged) Oracle Mobile Field Service / E-Business Suite account, which limits purely anonymous internet exploitation and pushes this toward insider or post-foothold scenarios. Note also a metadata tension: the input Tags label this 'Information Disclosure,' but the description and vector (I:H/A:H plus 'takeover') indicate full compromise, not mere disclosure - treat the tag as an understatement of impact. Net: prioritize patching (Oracle CPU October 2026), but absent EPSS/KEV/POC data, this reads as a patch-on-cycle-urgently item rather than a confirmed emergency.

An attacker who holds or phishes any low-privileged Oracle Mobile Field Service account (or who has already gained a foothold on the enterprise network where the EBS instance is reachable) sends crafted HTTP requests to the Internal Operations component. Because attack complexity is low and no user interaction is needed, the request drives the application to full takeover with confidentiality, integrity, and availability impact. No public exploit code is identified at time of analysis, so this scenario is inferred from the CVSS vector and vendor description rather than a released POC.