Oracle Field Service EUVD-2026-79468

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) describes an easy-to-automate, network-reachable confidentiality breach requiring only low privileges and no user interaction, with a scope change widening the blast radius - a serious data-exposure profile for an ERP system holding business-critical records. However, the exploitation probability signals are weak or absent: there is no CISA KEV listing, no public proof-of-concept referenced, and no EPSS score was supplied, so real-world likelihood of exploitation cannot be quantified from the input. The 'Authentication Bypass' tag conflicts with the PR:L metric - the vector indicates the attacker must already hold a valid low-privileged account, not that authentication is bypassed pre-auth; defenders should treat this as an authenticated privilege/authorization gap rather than an unauthenticated entry point and verify with Oracle if the distinction matters to their threat model. Net assessment: a genuine priority for organizations running Oracle EBS 12.2.x exposed to untrusted networks or with many low-privilege/internal users, but not an urgent internet-wide emergency based on the exploitation evidence available.

An attacker with an ordinary low-privileged Oracle E-Business Suite account - a contractor, a field technician, or a compromised credential - sends crafted HTTP requests to a Field Service endpoint protected primarily by client-side or missing server-side authorization checks. Because no user interaction or elevated role is needed and the flaw crosses a scope boundary, the attacker reads records belonging to other users, business units, or adjacent EBS modules, harvesting critical data in bulk. Automatable and low-complexity per the CVSS vector, though no public exploit code is known at time of analysis.