Mobile Field Service EUVD-2026-106069

Exploitation requires network HTTP access to the Oracle Mobile Field Service Admin UI component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, plus a valid low-privilege account on the system (PR:L) - it is NOT pre-authentication. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once an attacker holds any low-privilege credential the attack is reliable. The primary limiting factors are the authentication requirement and network reachability of the EBS web tier; internet-exposed EBS instances are at materially higher risk than those behind VPN/internal-only access. No special non-default feature or configuration toggle is called out in the description.

This is a genuine high-priority vulnerability, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) describes a remotely reachable flaw over HTTP with low attack complexity, no user interaction, and only low privileges required - meaning any authenticated low-level user can fully read and modify all Oracle Mobile Field Service data (C:H/I:H), with no availability impact (A:N). The high score is driven by the broad data compromise rather than by pre-auth exposure. Weighing other signals: no EPSS score was provided, the CVE is NOT on the CISA KEV list, and no public POC is referenced, so there is no public exploit identified at time of analysis - this is a patch-on-cycle priority, not an actively-exploited zero-day. One conflict to flag: the input Tags include 'Authentication Bypass', but the CVSS vector is PR:L and the description explicitly says 'low privileged attacker', which contradicts an authentication-bypass characterization - this appears to be a privilege-abuse/data-access flaw requiring valid credentials, not a bypass. Treat the 'Authentication Bypass' tag as unverified. Overall: real risk for internet-exposed EBS instances, but exploitation requires a valid (even if low-privilege) account.

A low-privileged authenticated user (or an attacker who has phished/obtained any valid EBS account) sends crafted HTTP requests to the Oracle Mobile Field Service Admin UI and abuses insufficient authorization controls to read, alter, or delete all data accessible to the service. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means exploitation would be straightforward once a foothold account exists.