Oracle Mobile Field Service: Improper access control allows product takeover
Summary
Oracle Mobile Field Service, a module of Oracle E-Business Suite 12.2, contains an improper access control flaw (CWE-284). An attacker with a low-privileged account and network access via HTTPS can take over the product, with high impact on confidentiality, integrity and availability. Exposure depends on whether the module is reachable from untrusted networks in your environment.
Affected
- Oracle Mobile Field Service, supported versions 12.2.3 through 12.2.15 (CNA record)
Fixed in
- Fixed in Oracle's October 2026 Critical Patch Update (released 20 October 2026).
- Specific EBS patch number for this CVE: Unknown. Oracle points to MOS KA923 and KA1818 (Oracle support login required).
Workaround
- No vendor workaround known.
- Until patched, restrict access to the Mobile Field Service URLs to known field-worker networks or VPN.
Exploitation
- No evidence of exploitation in the wild found as of 21 October 2026; not listed in CISA KEV at that check.
- Oracle reports no exploitation of these CVEs.
- No public proof of concept found. EPSS score 0.00433.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check whether EBS 12.2 with Mobile Field Service is in use and which version is installed.
- Apply the October 2026 CPU patch for this product, including the other Mobile Field Service CVEs in the same CPU.
- Until patched, restrict access to known networks or VPN and review which accounts can reach the module.
- Check logs for unusual logins and recheck CISA KEV and the Oracle advisory after patching.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 CPU www.oracle.com
- Oracle E-Business Suite Technology Blog: October 2026 CPU blogs.oracle.com
- Vulners CVE record CVE-2026-101654 vulners.com
- Strix CVE-2026-101654 www.strix.ai
- Brandefense: Oracle October 2026 CPU brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:22.
Original description (NVD)
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.