{"id":"CVE-2026-101656","published":"2026-10-20T22:18:19.963","lastModified":"2026-10-24T04:18:12.877","description":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-284"],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A vulnerability in Oracle Mobile Field Service (part of Oracle E-Business Suite) allows a low-privileged attacker with network access via HTTPS to compromise the application, leading to full takeover (CIA impact). The flaw resides in the 'Internal Operations' component and is easily exploitable due to lack of sufficient access controls (CWE-284: Improper Access Control).","exploitability":"Exploitation requires only a low-privileged authenticated user with network access over HTTPS; no user interaction or complex conditions are needed.","blast_radius":"","remediation":"Upgrade Oracle E-Business Suite to the version that includes the fix for CVE-2026-101656; since the description does not specify a fixed version, patch level, or release, apply the latest security patch released by Oracle for this CVE as per Oracle’s Critical Patch Update advisory.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["access-control","web-app","oracle","ebs","takeover"],"model":"garnet-coder","analyzedAt":"2026-10-27T08:51:38.566Z"}}