EUVD-2026-106065
GHSA-93qg-j64c-x495
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Mobile Field Service HTTP endpoint
-
ExploitSend crafted unauthenticated request
-
ExecutionBypass access checks on Admin UI
-
ImpactRead critical application data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the Oracle Mobile Field Service Admin UI over HTTP on an affected Oracle E-Business Suite release (12.2.3 through 12.2.15); no authentication, credentials, or user interaction are needed (PR:N/UI:N). The primary limiting factor is network exposure - instances restricted to internal/segmented networks or behind access controls in front of the Admin UI are far less exposed than internet-facing EBS deployments. Impact is confined to confidentiality (C:H, I:N, A:N), so exploitation yields data disclosure only, not modification or disruption. |
| Impact | Oracle rates this 7.5 (High) with a clean remote-unauthenticated confidentiality-only profile: AV:N/AC:L/PR:N/UI:N means any attacker who can reach the Mobile Field Service HTTP interface can exploit it with no credentials, no user interaction, and low complexity, but the impact is bounded to C:H (no integrity or availability loss, scope unchanged). This makes it an information-disclosure/data-exposure issue rather than a code-execution or takeover flaw. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or imminent widespread exploitation at time of analysis - exploitation status is 'no public exploit identified at time of analysis.' Net: the low attack complexity and lack of authentication make this genuinely attractive and easy to weaponize if an instance is internet-exposed, so it should be patched promptly; however, the absence of exploitation signals (EPSS/KEV/POC) means it is currently a patch-on-schedule priority rather than an emergency, and the real exposure hinges on whether the Mobile Field Service Admin UI is reachable from untrusted networks. Note the input 'Authentication Bypass' tag overstates the mechanism: the description characterizes this as unauthenticated access to data, not a defeat of an authentication control - treat the mechanism as unauth data disclosure. |
| Exploit ScenarioDerived | An attacker who can reach the Oracle Mobile Field Service Admin UI over HTTP sends crafted unauthenticated requests to the exposed endpoint and retrieves sensitive application data without any login or user interaction. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this works remotely against a reachable instance with minimal effort; no public exploit code is identified at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated data disclosure in the Oracle Mobile Field Service Admin UI component of Oracle E-Business Suite 12.2.3 through 12.2.15 allows any attacker who can reach the HTTP interface to read critical data without credentials or user interaction. Oracle rates it 7.5 (High) with a confidentiality-only profile (C:H, I:N, A:N), so exploitation yields data exposure rather than modification or disruption, and the practical exposure depends almost entirely on whether the Admin UI is internet-facing or segmented. No public exploit code or confirmed active exploitation was identified at time of analysis; Oracle's October 2026 CPU advisory is the reference for fixes.
RemediationAI
Apply the October 2026 Oracle Critical Patch Update for E-Business Suite - the CPU at https://www.oracle.com/security-alerts/cpuoct2026.html is the authoritative fix source and lists the minimum patched versions per 12.2.x release; there is no independent tagged fix version in the supplied data, so verify the exact required patch level in that advisory before signing off. Vendor-released patch availability should be confirmed for your specific 12.2.3-12.2.15 build, since EBS patching is applied per-release and per-module rather than as a single universal update. As compensating controls pending or in lieu of patching: put the Mobile Field Service Admin UI behind an authenticating reverse proxy or VPN and restrict it to management networks, which is the strongest mitigation given PR:N/UI:N but adds operational friction for field and admin staff; block or filter HTTP access to the Admin UI paths at the load balancer/WAF, accepting that any shared paths must be identified first to avoid breaking legitimate Mobile Field Service traffic; and disable or undeploy Mobile Field Service where the module is not actively used, which removes exposure entirely at the cost of that business function. Because the impact is confidentiality-only (I:N/A:N), detection should focus on reviewing web/access logs for anomalous unauthenticated requests to Admin UI endpoints and on hunting for signs of bulk data retrieval, rather than on integrity or availability anomalies.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the Admin UI of Oracle Mobile Field Service, an E-Business Suite module used by field technicians and dispatched staff, delivered over HTTP on top of Oracle's EBS technology stack (Apache/OHS front end with the Oracle Forms/OC4J-style application tier). The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes a missing or improperly enforced authorization/authentication check on a network-reachable Admin UI endpoint: the attacker needs no account (PR:N) and no victim interaction (UI:N), and the attack does not require a race, unusual configuration, or specialized conditions (AC:L). Because the impact is confined to confidentiality with scope unchanged, the expected outcome is disclosure of data the anonymous requester should never see - configuration or administrative data reachable through the Admin UI - rather than injection-driven code execution or state change. No CWE was supplied, so the root-cause class is best characterized from the vector as an authentication/access-control weakness (CWE-306/CWE-862 family) on an administrative interface; this classification should be treated as inference, not vendor-confirmed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated HTTP access with low complexity and no user interaction yields AV:N/AC:L/PR:N/UI:N; impact is confidentiality-only (C:H, I:N, A:N), scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle E-Business Suite's Mobile Field Service Admin UI in versions 12.2.3 through 12.2.15 presents a high-severity confidentiality risk that could expose critical business data to parties able to reach the interface. Leadership should care because the exposure is data-focused rather than disruptive, and its business consequence depends on whether the Admin UI is internet-facing or otherwise broadly reachable. No public exploit identified at time of analysis, but no vendor-released patch was identified either, so near-term risk reduction should focus on access restriction and monitoring while Oracle's October 2026 CPU guidance is awaited.
No vendor-released patch identified at time of analysis; restrict access to the Mobile Field Service Admin UI via VPN/allowlist or disable it, segment affected Oracle E-Business Suite 12.2.3-12.2.15 instances from untrusted networks, enforce WAF/access-control rules, and monitor logs for anomalous data reads until Oracle's October 2026 CPU fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB