Mobile Field Service CVE-2026-101636

Exploitation targets the Admin UI component of Oracle Mobile Field Service within Oracle E-Business Suite versions 12.2.3 through 12.2.15, reachable over HTTP by an unauthenticated attacker (PR:N, UI:N). The decisive limiting factor is high attack complexity (AC:H) - Oracle rates this 'Difficult to exploit,' meaning success depends on conditions the attacker does not directly control (such as specific server state, timing/race conditions, or environmental preconditions), not a deterministic single-request exploit. Practical risk is further bounded by network exposure: an EBS instance whose Mobile Field Service Admin UI is not reachable from the attacker's network position is not exploitable. There is no availability impact (A:N); impact is confined to unauthorized read, creation, deletion, or modification of Mobile Field Service-accessible data.

This is a genuinely notable issue but not a drop-everything emergency. The CVSS 3.1 base score of 7.4 (HIGH) is driven by network reach (AV:N), no authentication (PR:N), no user interaction (UI:N), and high confidentiality and integrity impact (C:H/I:H), but it is tempered by high attack complexity (AC:H) and no availability impact (A:N). The AC:H metric is the key moderating signal: Oracle's own 'Difficult to exploit' language and the vector agree that successful attack requires conditions outside the attacker's direct control (e.g., winning a race, specific state, or non-trivial preconditions), which lowers the practical exploitation rate relative to a clean AV:N/AC:L/PR:N bug. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis and no confirmed active exploitation. The combination - unauthenticated network C:H/I:H but AC:H and no corroborating exploitation telemetry - places this as a real patch-cycle priority for Oracle E-Business Suite operators (especially internet-exposed EBS instances), but not an in-the-wild crisis. EPSS data is missing, so widespread-exploitation probability cannot be quantified from the input. The 'Authentication Bypass' tag should be read cautiously: the vector is PR:N (no authentication required at all), which is distinct from bypassing an authentication control - the description does not actually describe a bypass mechanism.

An unauthenticated attacker with HTTP access to an exposed Oracle Mobile Field Service Admin UI sends a specially crafted request that exploits the flaw to read or tamper with application data. Because attack complexity is high (AC:H), the attacker must satisfy additional conditions - such as specific server state or timing - rather than firing a single reliable payload. No public proof-of-concept was identified in the provided data.