Mobile Field Service CVE-2026-101675

Exploitation requires the attacker to already possess HIGH-privileged logon (PR:H) to the infrastructure/host where Oracle Mobile Field Service executes, and access is LOCAL (AV:L) - there is no network-facing attack path. No user interaction is required (UI:N) and attack complexity is low (AC:L) once the privilege prerequisite is met. Affected deployments are Oracle Mobile Field Service versions 12.2.3 through 12.2.15 within Oracle E-Business Suite via the Internal Operations component. The key limiting factors for defenders: the need for pre-existing high privileges and local access confines realistic exploitation to insiders or attackers who have already compromised the host, and applying the October 2026 Oracle CPU remediates it.

This is a genuine but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N) confirms that exploitation requires LOCAL access plus HIGH privileges on the host where Oracle Mobile Field Service runs - the attacker must already have authenticated, high-privileged logon to the infrastructure, which sharply limits the pool of potential attackers to insiders or those who have already gained a strong foothold. The 6.7 (Medium) base score is held down by the PR:H and AV:L constraints despite full C:H/I:H/A:H impact (complete product takeover). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vendor's own description calling it 'easily exploitable' refers only to attack complexity (AC:L) once the privilege prerequisite is met - it does NOT mean low-privilege or remote. Signals are consistent (no conflict between CVSS, EPSS, KEV, and description): all point to a high-impact-but-high-barrier flaw. Realistic risk is driven by post-compromise privilege escalation / insider-threat scenarios rather than mass internet exploitation.

An attacker who already holds high-privileged local logon to the server running Oracle Mobile Field Service (e.g., a malicious insider or an actor who has pivoted onto the EBS host) leverages the Internal Operations component flaw to fully compromise the Mobile Field Service product. Because attack complexity is low (AC:L) and no user interaction is needed, exploitation is straightforward once the privilege prerequisite is satisfied. No public exploit code was identified in the provided data.