Mobile Field Service CVE-2026-101654

Exploitation requires a pre-existing authenticated low-privileged account on the Oracle E-Business Suite instance (CVSS PR:L), reachable over the network via HTTPS against the Mobile Field Service product's Internal Operations component, in affected versions 12.2.3 through 12.2.15. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so a single valid low-tier credential plus network/HTTPS reachability to the Mobile Field Service endpoint is sufficient. Limiting factors: the mandatory authentication requirement prevents anonymous exploitation, and only the 12.2.3-12.2.15 release range is affected, so instances outside that range or not exposing Mobile Field Service to low-privilege users are not at risk.

This is a genuinely high-priority flaw. The CVSS 3.1 base score of 8.8 is driven by a network attack vector (AV:N over HTTPS), low attack complexity (AC:L), no user interaction (UI:N), and full confidentiality, integrity, and availability impact (C:H/I:H/A:H) culminating in complete product takeover. The one factor limiting raw severity is PR:L - the attacker must already hold a low-privileged, authenticated account, which rules out fully anonymous internet exploitation. Against that strong technical profile, several real-world signals are simply absent from the input: no EPSS exploitation-probability score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is therefore no evidence of active, in-the-wild exploitation; the urgency here comes from the technical impact and Oracle's own 'easily exploitable' language rather than observed attacks. One signal conflict to verify: the input Tags label this 'Information Disclosure,' yet both the description (full 'takeover') and the CVSS vector (I:H/A:H) indicate integrity and availability compromise well beyond disclosure - treat the tag as understating impact and rely on the CVSS vector. SSVC-style reading: exploitation=none observed, technical impact=total, automatable=likely no (authentication required), supporting a 'track/attend' rather than 'act immediately' posture unless the product is internet-exposed to many low-privilege users.

An attacker who has obtained any low-privileged Oracle E-Business Suite account (for example a legitimate field-service user, a compromised employee credential, or a self-registered low-tier user) sends crafted HTTPS requests to the Mobile Field Service component. Because the flaw requires no user interaction and low attack complexity, these requests escalate the attacker's access to a full takeover of Oracle Mobile Field Service, exposing and altering its data and operations. No public proof-of-concept exploit is referenced in the available intelligence.