EUVD-2026-106068
GHSA-89mf-p286-w434
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege EBS account
-
DeliveryReach Mobile Field Service over HTTP
-
ExploitSend crafted request to Internal Operations
-
ExecutionExploit flaw to escalate
-
ImpactFull takeover of Mobile Field Service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to an Oracle E-Business Suite deployment running Oracle Mobile Field Service versions 12.2.3 through 12.2.15, plus a valid low-privilege authenticated account on that instance (PR:L) - it is not exploitable by fully anonymous attackers. No user interaction and no special non-default configuration are indicated by the vector. The practical limiting factor is the need for valid low-privilege credentials; risk rises sharply where the EBS login interface is internet-exposed or where low-privilege accounts are numerous or easily obtained. |
| Impact | This is a genuine high-priority issue for organizations running Oracle E-Business Suite. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability compromise ('takeover' of Oracle Mobile Field Service). The only meaningful barrier is PR:L - the attacker must hold a valid low-privilege account on the EBS instance, which materially lowers risk versus a fully unauthenticated flaw but is a low bar in large enterprises with many users or internet-exposed EBS login portals. Critical signals are MISSING: no EPSS score was provided, so exploitation probability cannot be quantified; the vulnerability is NOT in CISA KEV (no confirmed active exploitation); and no public POC is referenced. The 'Information Disclosure' tag conflicts with the actual impact - full CIA takeover is far broader than information disclosure, so the tag understates severity. Bottom line: treat as high priority on the Oracle October 2026 CPU patch cycle given the easily-exploitable, low-privilege, full-takeover profile, but note that exploitation is not yet confirmed in the wild and no exploit code is publicly identified. |
| Exploit ScenarioDerived | An attacker holding any low-privilege Oracle E-Business Suite account (or who has phished/obtained such credentials) sends crafted HTTP requests to the Mobile Field Service Internal Operations component over the network. Because attack complexity is low and no user interaction is needed, the attacker escalates to full control of the Mobile Field Service module, compromising its data and operations. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Authenticated low-privilege users can take over Oracle Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15 by sending crafted HTTP requests, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 8.8 because a single valid low-privilege account yields full confidentiality, integrity, and availability impact on the component. No user interaction and no non-default configuration are required, so the practical barrier is holding or obtaining any valid EBS account; risk rises sharply where the EBS login interface is internet-exposed or low-privilege accounts are numerous or easily obtained. No public exploit code or CISA KEV entry was identified at time of analysis, but this remains a genuine high priority for organizations running the affected E-Business Suite releases.
RemediationAI
Apply the Oracle Critical Patch Update (October 2026) referenced at https://www.oracle.com/security-alerts/cpuoct2026.html; the supplied data does not specify a discrete patched version number, so confirm the fixed EBS 12.2.x release level for Mobile Field Service in My Oracle Support before upgrading. Because the vector requires only a low-privilege authenticated account, reduce exposure in the interim: restrict HTTP access to the EBS and Mobile Field Service endpoints behind a reverse proxy, VPN, or IP allowlist so only known field devices can reach them (trade-off: mobile workers lose direct connectivity and need an alternative access path), enforce MFA and aggressively prune or disable unused low-privilege EBS accounts (trade-off: account lifecycle overhead and possible disruption to legitimate users), and monitor application and database logs for anomalous privileged actions performed by low-privilege accounts (trade-off: requires a tuned baseline to avoid alert fatigue). Patching is the only complete fix; the network and account controls described above only lower the probability of exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Mobile Field Service is a module within Oracle E-Business Suite, Oracle's integrated ERP/CRM application stack, and the affected 'Internal Operations' component handles the server-side processing behind mobile field service workflows. The issue is reachable over HTTP (AV:N, AC:L) by an attacker holding a valid low-privilege EBS account (PR:L), and a successful attack produces full loss of confidentiality, integrity, and availability on the Mobile Field Service component (C:H/I:H/A:H, S:U) - effectively a vertical privilege escalation in which a routine, minimally privileged user gains control of the module and its data. No CWE identifier was supplied in the vulnerability data, so the root-cause class (for example an authorization bypass, missing access-control check, or unsafe data handling) cannot be confirmed from the available sources; the Oracle Critical Patch Update October 2026 advisory at https://www.oracle.com/security-alerts/cpuoct2026.html should be treated as the definitive technical reference. The CVSS scope is unchanged (S:U), meaning the compromise is scored within the Mobile Field Service security authority rather than the whole EBS platform, although in practice an EBS module compromise is often a stepping stone toward broader application access.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP access with low complexity and no user interaction; PR:L because a low-privilege account is required; full takeover gives C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite releases 12.2.3 through 12.2.15 contain a high-severity flaw in Oracle Mobile Field Service that allows any authenticated low-privilege user to take over the component, affecting the confidentiality, integrity, and availability of business data and processes. Leadership should treat this as a priority access-control risk because the barrier is a single valid EBS account, and exposure rises sharply where the EBS login interface is internet-facing or low-privilege accounts are numerous or easily obtained. No public exploit or CISA KEV entry was identified at time of analysis, but no vendor-released patch was identified at time of analysis, so interim containment is required.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to the Oracle E-Business Suite login interface (especially internet exposure), minimizing and auditing low-privilege accounts, enforcing least privilege, and monitoring for anomalous HTTP requests to Oracle Mobile Field Service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB