Mobile Field Service CVE-2026-101655

Exploitation requires network access to the Oracle Mobile Field Service component (Internal Operations) over HTTP plus a valid low-privilege Oracle E-Business Suite account (PR:L) - it is not anonymous/unauthenticated. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once an attacker holds any authenticated foothold the attack is straightforward. Affected deployments are Oracle E-Business Suite 12.2.3 through 12.2.15 running the Mobile Field Service module; environments not running this module are not exposed. The main limiting factor is the authentication requirement; the main aggravating factor is that low-privilege EBS accounts are common and the resulting impact is full application takeover.

This is a genuinely high-priority vulnerability by its technical profile, though exploitation-signal data is thin. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) describes a network-reachable flaw over HTTP, low attack complexity, no user interaction, and only low-level privileges required to achieve full confidentiality, integrity, and availability compromise - Oracle explicitly states this results in 'takeover' of Oracle Mobile Field Service. The one meaningful barrier is PR:L: an attacker needs some authenticated foothold (a low-privilege EBS account), which rules out purely anonymous internet exploitation but is a low bar in environments with many users or self-registration. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of exploitation signals should not be read as low risk: this is a freshly disclosed Oracle Critical Patch Update (October 2026) issue, so EPSS/KEV data would not yet exist regardless of eventual exploitability. Note also a metadata conflict - the input 'Information Disclosure' tag understates the impact, since the CVSS vector and description both indicate full CIA takeover, not mere disclosure.

An attacker who holds or obtains a low-privilege Oracle E-Business Suite account sends crafted HTTP requests to the Mobile Field Service component's Internal Operations interface, abusing the flaw to escalate to full control of the application. Because attack complexity is low and no user interaction is needed, the attack is reliable once network access and a basic credential are available. No public exploit code has been identified at time of analysis.