EUVD-2026-106095
GHSA-v9mg-7j7j-q9xp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege EBS account
-
DeliverySend crafted HTTP request to Admin UI
-
ExploitExploit Mobile Field Service flaw
-
ExecutionGain full application control
-
ImpactCompromise confidentiality, integrity, availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to the Oracle Mobile Field Service Admin UI component of Oracle E-Business Suite and a low-privilege authenticated account on the EBS instance (CVSS PR:L) - it is NOT remote-unauthenticated. Affected deployments are E-Business Suite versions 12.2.3 through 12.2.15 running the Mobile Field Service module; environments that do not deploy this module are not exposed. No user interaction is required (UI:N) and attack complexity is low (AC:L), so the principal limiting factor is the need for valid, if minimally privileged, application credentials and reachability of the Admin UI endpoint. |
| Impact | This is a credible, actionable priority rather than a paper-tiger high-CVSS issue, though not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability loss - consistent with the description's claim of complete 'takeover' of Oracle Mobile Field Service. The key tempering factor is PR:L: an attacker needs an authenticated, albeit low-privilege, foothold (e.g., any valid EBS application account), which meaningfully narrows the exploit population versus a PR:N bug. No EPSS score, SSVC decision data, KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified; absence of these is not evidence of safety but does mean there is no current signal of active or imminent exploitation. One data tension to verify: the 'Information Disclosure' tag understates the vulnerability, which per the CVSS vector and 'takeover' wording is a full compromise (I:H/A:H), not merely disclosure. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege account on the Oracle E-Business Suite instance sends crafted HTTP requests to the Mobile Field Service Admin UI component over the network. Exploiting the flaw with low attack complexity and no user interaction, they escalate to full control of the Mobile Field Service application, reading and altering data and disrupting availability. No public exploit identified at time of analysis, so this scenario is inferred from the CVSS vector rather than demonstrated code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes the Admin UI to a low-privileged authenticated network attacker over HTTP, allowing takeover of the module with high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires valid application credentials and reachability of the Admin UI endpoint; it is not remote-unauthenticated, and deployments without the module are not exposed. No public exploit code was identified at time of analysis.
RemediationAI
Apply the Oracle October 2026 Critical Patch Update for Oracle E-Business Suite 12.2.3-12.2.15; patch availability is per the vendor advisory at https://www.oracle.com/security-alerts/cpuoct2026.html, and no separate fixed build number was provided in the input. If patching must be delayed, restrict HTTP access to the Mobile Field Service Admin UI to trusted administrative networks or via a reverse proxy/ACL, understanding that this may disrupt field-service integrations and remote admin workflows; alternatively, disable the Mobile Field Service module if it is not operationally required, accepting the loss of that functionality. Also review and remove unnecessary low-privilege EBS accounts, since PR:L is the main prerequisite, and monitor Admin UI activity for anomalous changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue resides in the Admin UI component of Oracle Mobile Field Service, a module within Oracle E-Business Suite. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a network-reachable flaw with low attack complexity that requires a low-privilege authenticated account and no user interaction, resulting in high impact to confidentiality, integrity, and availability within the affected module. Oracle did not assign a CWE in the provided data, so the precise root-cause class is not confirmed; the practical exposure is the HTTP-accessible Admin UI endpoint in EBS 12.2.3-12.2.15 deployments that have Mobile Field Service enabled.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP vector (AV:N), low complexity (AC:L), and a required low-privilege account (PR:L); 'takeover' justifies C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite Mobile Field Service versions 12.2.3 through 12.2.15 carry a high-severity module-takeover risk that could disrupt field-service operations, expose sensitive operational data, and permit unauthorized changes for organizations running the module with a reachable Admin UI. Leadership should prioritize exposure review because no vendor-released patch was identified at time of analysis, while the absence of public exploit code means urgency is concentrated on internet- or broadly accessible deployments. Deployments without the module are not exposed.
No vendor-released patch identified at time of analysis; restrict Mobile Field Service Admin UI reachability to trusted networks, disable the module where not required, enforce least privilege and credential hygiene, monitor for anomalous Admin UI activity, and apply vendor workarounds or upgrade guidance when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB