Oracle Mobile Field Service: Privilege escalation in Admin UI
Summary
Oracle Mobile Field Service, an optional add-on to Oracle E-Business Suite, contains a vulnerability in its Admin UI (CWE-284, improper access control). An attacker with a low-privileged account and network access via HTTP can compromise the product, with high impact on confidentiality, integrity and availability according to the CVSS vector. The exact attack path is not described in detail in the available sources, and Oracle's advisory was not verified for patch details.
Affected
- Oracle Mobile Field Service in Oracle E-Business Suite, versions 12.2.3 to 12.2.15
- Affected component: Admin UI
Fixed in
Unknown. Check the Oracle Critical Patch Update Advisory of October 2026 and My Oracle Support for the Mobile Field Service Admin UI patch for 12.2.x.
Workaround
- No vendor-published workaround found.
- Until the patch is applied: remove internet exposure of the Admin UI and restrict it to management networks or VPN.
- Review accounts with Admin UI access and remove unused ones.
- Monitor HTTP access logs of the Admin UI for unusual requests.
Exploitation
- Exploited in the wild: no evidence found in the available sources.
- Public proof of concept: none found.
- CISA KEV status: not verified.
- EPSS: 0.00464 (very low).
- Vulnerability scanners can check for this CVE via a Tenable plugin covering the October 2026 EBS CPU.
Our recommendation
- Check whether Oracle Mobile Field Service is deployed at all; it is an optional EBS add-on.
- If deployed, verify whether the Admin UI is reachable from the internet and remove that exposure.
- Apply the Oracle October 2026 patch for 12.2.x as soon as it is confirmed, and verify the fixed version with the vendor.
- Review low-privileged accounts on the EBS system and monitor the Admin UI.
- Verify the CVSS score (8.8) against the Oracle advisory, as the related CVE-2026-101665 is scored 8.1.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory, October 2026 www.oracle.com
- Oracle Mobile Field Service product page www.oracle.com
- Vulners CNA data for CVE-2026-101692 vulners.com
- Vulners NVD record for CVE-2026-101692 vulners.com
- Strix summary for CVE-2026-101692 (secondary) www.strix.ai
- Tenable/Nessus plugin for Oracle EBS CPU October 2026 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:21.
Original description (NVD)
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.