Oracle Field Service CVE-2026-60739

Exploitation requires network access to the Oracle Field Service HTTP interface (the EBS application tier) and a low-privilege authenticated session (CVSS PR:L), targeting the Internal Operations component of EBS versions 12.2.3-12.2.15; no user interaction and no elevated privileges are needed (UI:N, AC:L), which is why Oracle labels it easily exploitable. Limiting factors: the target must be a 12.2.x EBS deployment with Field Service in use and reachable over the network, and the attacker must already possess a valid low-privilege account - note the vendor 'Authentication Bypass' tag partially conflicts with the PR:L requirement and should be confirmed with Oracle, as a true bypass would remove the authentication precondition.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) describes a network-reachable, low-complexity attack that requires only low privileges and no user interaction, which Oracle characterizes as 'easily exploitable' - a genuine concern for internet- or intranet-exposed EBS environments where low-privilege accounts are common. The dominant impact is confidentiality (C:H - complete read access to Field Service data) with limited integrity impact (I:L) and no availability impact (A:N). Countervailing signals lower the urgency: this is not listed on CISA KEV, no EPSS probability was provided, and no public proof-of-concept has been identified, so there is currently no evidence of active or imminent exploitation. The main uncertainty is the 'Authentication Bypass' tag, which conflicts with the CVSS PR:L requirement for an authenticated attacker - verify with Oracle whether a valid low-privilege session is truly required or whether authentication can be circumvented, as this materially changes exposure.

An attacker holding or obtaining a low-privilege Oracle Field Service account sends crafted HTTP requests to the Internal Operations component and, exploiting the access-control weakness, retrieves Field Service data that should be outside their authorization scope and performs limited unauthorized inserts, updates, or deletes. Because the attack has low complexity and needs no user interaction, it can be automated once a valid low-privilege session is available. No public proof-of-concept has been identified at time of analysis.