Oracle Mobile Field Service CVE-2026-101653

Exploitation requires a valid but low-privileged authenticated account on Oracle Mobile Field Service within Oracle E-Business Suite (PR:L), reachable over HTTPS (AV:N). Affected deployments are EBS versions 12.2.3 through 12.2.15 with the Mobile Field Service product and its Internal Operations component in use; environments not running Mobile Field Service are not exposed. No user interaction is required and attack complexity is low, so beyond holding credentials there are no additional configuration prerequisites stated in the advisory. The limiting factors are therefore the need for pre-existing authenticated access and the presence of the specific affected product/version.

This is a genuine high-priority vulnerability, though not an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is internally consistent with the description: network-reachable over HTTPS, low attack complexity, only low privileges required, no user interaction, and full compromise of confidentiality, integrity and availability ('takeover'). The single meaningful barrier is PR:L - a valid, low-privileged EBS account is needed, which downgrades this from a pure perimeter break to a privilege-escalation/account-abuse risk. No EPSS score, SSVC decision, KEV listing, or POC was supplied in the intelligence set, so exploitation likelihood cannot be quantified and there is currently no public exploit identified at time of analysis. Oracle sources this through its quarterly CPU (October 2026) rather than an out-of-band alert, which is consistent with no known active exploitation. One data inconsistency to flag: the Tags include 'Information Disclosure', yet the description and CVSS both indicate full takeover (C:H/I:H/A:H), so the vulnerability is materially broader than information disclosure alone - treat the tag as under-scoped, not authoritative.

An attacker who already holds a low-privileged Oracle Mobile Field Service / EBS account sends crafted requests over HTTPS to the Internal Operations component, exploiting the flaw to escalate to full control of the Mobile Field Service application. Because attack complexity is low and no user interaction is needed, a single authenticated session is sufficient to achieve complete compromise of data and service. No public proof-of-concept was identified in the provided data.