EUVD-2026-106067
GHSA-vpqj-4mx2-8q4h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege EBS account
-
ExploitReach Mobile Field Service Admin UI over HTTP
-
ExecutionSend crafted request exploiting flaw
-
ImpactCreate, modify or delete critical data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a network-reachable Oracle Mobile Field Service Admin UI (HTTP) and a valid low-privileged account on affected Oracle E-Business Suite versions 12.2.3 through 12.2.15 - per PR:L, the attacker must already be authenticated at a low privilege level, which is the primary limiting factor. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once authenticated the attack is straightforward. Realistic risk is bounded by whether the Mobile Field Service Admin UI is exposed beyond trusted networks and how freely low-privilege EBS accounts are provisioned; internal-only deployments with tight account controls face materially lower exposure. |
| Impact | This is a genuinely notable but context-dependent risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) confirms network-based, low-complexity exploitation requiring a low-privileged authenticated account - so this is NOT a pre-auth remote flaw. The 7.1 base score is driven by high integrity impact (I:H) with only partial confidentiality loss (C:L) and no availability impact (A:N). No EPSS probability was supplied in the input, and there is no CISA KEV listing and no public POC, so there is no evidence of active exploitation or imminent weaponization. The input Tag 'Authentication Bypass' conflicts with the CVSS vector, which explicitly requires privileges (PR:L) rather than bypassing authentication - the description describes a privileged attacker abusing access, not bypassing it, so treat the tag as suspect. Net assessment: a real, patch-worthy integrity-focused flaw in an enterprise ERP module, but the authentication requirement and absence of exploitation signals place it below internet-facing pre-auth criticals in priority. Oracle E-Business Suite is a frequent target, so apply the October 2026 CPU promptly, especially where the Mobile Field Service module is internet-reachable. |
| Exploit ScenarioDerived | A low-privileged but authenticated user (or an attacker who has phished/obtained such credentials) reaches the Oracle Mobile Field Service Admin UI over HTTP and sends crafted requests that exploit the flaw. Because attack complexity is low and no user interaction is needed, the attacker can create, delete, or modify critical Mobile Field Service data and read a subset of accessible data. No public exploit code has been identified at time of analysis, so exploitation would currently require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
An authenticated low-privileged user with HTTP network access to the Oracle Mobile Field Service Admin UI in Oracle E-Business Suite 12.2.3 through 12.2.15 can escalate beyond their intended permissions, gaining the ability to create, delete or modify critical data and to read a subset of otherwise restricted data (CVSS 3.1 base score 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N). The flaw is easy to trigger once an attacker holds any valid low-privilege EBS account, but that authentication prerequisite is the main limiting factor, and exposure is largely determined by whether the Admin UI is reachable from untrusted networks. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; Oracle addresses the issue through its Critical Patch Update of October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), and EUVD (EUVD-2026-106067) corroborates the 12.2.3-12.2.15 affected range.
RemediationAI
Apply the Oracle Critical Patch Update of October 2026 for Oracle E-Business Suite to bring Mobile Field Service to a patched state; the advisory at https://www.oracle.com/security-alerts/cpuoct2026.html lists the affected 12.2.3-12.2.15 range and the corresponding fixes, and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-101662 can be used to track publication. Because exploitation requires a valid low-privilege account, the highest-value compensating control is to restrict the Mobile Field Service Admin UI at the network layer to trusted administrative segments, management VLANs or VPN-only access; the trade-off is that remote field-service staff or third-party integrators who currently reach the Admin UI directly will need alternative access paths or a jump host. In parallel, audit and periodically re-certify EBS user provisioning, removing dormant or over-provisioned low-privilege accounts, since the vulnerability amplifies what such an account can do; the trade-off is added administrative overhead and possible friction for legitimate users whose roles are trimmed. If neither is immediately feasible, enable detailed logging and alerting on Admin UI requests from accounts that do not normally use the module, and monitor for unusual create/modify/delete activity against Mobile Field Service data, accepting that detective controls do not prevent exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability sits in the Admin UI component of Oracle Mobile Field Service, a module of Oracle E-Business Suite that supports scheduling and dispatch of field service technicians and typically runs on the same application tier infrastructure as other EBS modules. No CWE identifier was assigned in the available data, but the intelligence tags classify the issue as an authentication/authorization bypass, which is consistent with the CVSS vector: the attacker must already hold a valid low-privilege account (PR:L) and the attack is network-reachable over HTTP with low complexity and no user interaction, yet the scope is unchanged (S:U), meaning the compromise stays within the Mobile Field Service security context. The resulting impact is an integrity-dominant one (I:H) over critical data with limited confidentiality loss (C:L); the absence of an availability component (A:N) means denial-of-service is not the primary concern. Because the weakness is a privilege/access-control enforcement gap rather than a memory-safety or injection flaw, successful exploitation depends less on technical tooling and more on whether a low-privileged EBS account exists and whether the Admin UI endpoints are exposed beyond trusted administrative networks.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
HTTP network vector (AV:N), low complexity (AC:L), requires an authenticated low-privilege account (PR:L); high integrity but partial confidentiality and no availability impact, matching the described data manipulation.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as unauthorized read access to a subset of Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Executive ViewAI
Oracle E-Business Suite 12.2.3 through 12.2.15 contains an authorization weakness in the Mobile Field Service Admin UI that lets any holder of a valid low-privilege account act beyond their assigned role, including altering or deleting business records and viewing restricted data. Because E-Business Suite typically underpins finance, supply chain, and field service operations, the exposure is to data and transaction integrity rather than to customer-facing systems, and the practical risk scales with the number of low-privilege accounts and whether the Admin UI is reachable from untrusted networks. Leadership should care because the prerequisite is an ordinary user account - a low bar for insiders, contractors, or anyone who has harvested credentials - and no remediation exists from the vendor yet.
No vendor-released patch identified at time of analysis; Oracle indicates remediation via its October 2026 Critical Patch Update. Interim mitigations: restrict network reachability of the Mobile Field Service Admin UI to trusted networks or VPN, minimize and review low-privilege accounts holding access, enforce strong authentication and session controls, and enable audit logging and alerting for privilege escalation and bulk data modification or deletion in EBS.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB