Mobile Field Service CVE-2026-101661

Exploitable only against the Admin UI component of Oracle Mobile Field Service (Oracle E-Business Suite) versions 12.2.3 through 12.2.15, reachable over HTTP. No authentication, privileges, or user interaction are required (PR:N/UI:N), so an internet- or intranet-exposed Admin UI is directly at risk. The primary limiting factor is the High attack complexity (AC:H): Oracle labels this 'difficult to exploit,' indicating the attacker must satisfy specific preconditions or non-deterministic state they cannot fully control, which constrains reliable or automated exploitation. The chief deployment-level mitigation is restricting network exposure of the Mobile Field Service Admin UI to trusted segments rather than the public internet.

This is a genuine but not top-tier priority. The CVSS 3.1 base score of 7.4 is driven by an attractive attack surface - network vector (AV:N) over HTTP with no authentication (PR:N) and no user interaction (UI:N) - combined with high confidentiality and integrity impact (C:H/I:H), allowing an attacker to read, create, modify, or delete all Oracle Mobile Field Service accessible data. The single most important mitigating signal is the High attack complexity (AC:H): Oracle explicitly describes this as 'difficult to exploit,' meaning success depends on conditions outside the attacker's direct control (e.g., winning a race, specific state, or non-deterministic preconditions), which materially lowers the odds of reliable mass exploitation. There is no availability impact (A:N). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active or at-scale exploitation at this time - the risk is currently theoretical/pre-disclosure-mitigation rather than demonstrated. Note a tag conflict: the input is tagged 'Authentication Bypass,' but the description characterizes this as an unauthenticated data-compromise flaw rather than a confirmed auth-bypass primitive - treat the tag as unverified. Overall: patch on the normal Oracle CPU cadence; AC:H and the absence of any exploitation signal argue against emergency out-of-band action unless Mobile Field Service is internet-exposed.

An unauthenticated attacker with network reach to an internet-facing or intranet-exposed Oracle Mobile Field Service Admin UI sends specially crafted HTTP requests designed to satisfy the specific (and hard-to-meet) conditions required to trigger the flaw. On success, they read, alter, or delete critical field-service data across the application. No public exploit code was identified in the provided data, and the High attack complexity means a working attack likely requires significant effort or specific environmental conditions.