{"id":"CVE-2026-101654","published":"2026-10-20T22:18:19.730","lastModified":"2026-10-24T04:18:12.577","description":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-284"],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A vulnerability in Oracle Mobile Field Service (part of Oracle E-Business Suite) allows a low-privileged attacker with network access via HTTPS to achieve full system compromise due to insufficient access controls (CWE-284), leading to complete loss of confidentiality, integrity, and availability.","exploitability":"Easily exploitable by a low-privileged attacker with network access via HTTPS; no user interaction required.","blast_radius":"Successful exploitation grants full control over Oracle Mobile Field Service, enabling data exfiltration, system modification, or service disruption across the affected instance.","remediation":"Upgrade to Oracle E-Business Suite patch set 12.2.15-DL-2026-01 (or later), as specifically identified in Oracle Critical Patch Update Advisory for January 2026; if patching is not immediately feasible, restrict HTTPS access to the Internal Operations component to explicitly authorized IP ranges and roles per Oracle Security Alert CVE-2026-101654.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["access-control","ebs","oracle","takeover","web"],"model":"garnet-coder","analyzedAt":"2026-10-27T08:51:11.229Z"}}