{"id":"CVE-2026-101634","kind":"vulnerability","aliases":["CVE-2026-101634"],"related":[],"title":"Oracle Mobile Field Service: unauthenticated HTTP flaw exposes data and crashes service","description":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Field Service. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).","summary":"Oracle Mobile Field Service in Oracle E-Business Suite versions 12.2.3 to 12.2.15 has a flaw that a remote attacker can reach over HTTP without logging in. A successful attack gives access to critical data and can hang or repeatedly crash the service.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle E-Business Suite (Mobile Field Service)","fixed":["Oct 2026 CPU patch 40022426 (per Rapid7, unverified on Oracle MOS)"],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["mobile-field-service","oracle-ebs","other","self-hosted","unauthenticated","vendor"],"not_affected_if":["cpu-oct-2026-applied","mobile-field-service-not-installed"],"how_to_check":"Check whether Oracle Mobile Field Service is installed in your EBS 12.2 instance and whether the October 2026 CPU EBS patch is applied (compare against patch 40022426 in OPatch/AD patch history, e.g. ad_applied_patches). Affected: EBS 12.2.3 through 12.2.15. Also check whether the EBS web tier is reachable from the internet.","fix":"Apply the October 2026 Oracle Critical Patch Update for Oracle E-Business Suite (Rapid7 cites patch 40022426; confirm in Oracle's EBS patch availability document on My Oracle Support). Oracle gives no workaround in the sources read.","status":"open","published_at":"2026-10-20T22:18:17+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:38:53+00:00","updated_at":"2026-10-23T23:07:06+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:38:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Mobile Field Service: unauthenticated HTTP flaw exposes data and crashes service","impact":"high","summary":"Oracle Mobile Field Service in Oracle E-Business Suite versions 12.2.3 to 12.2.15 has a flaw that a remote attacker can reach over HTTP without logging in. A successful attack gives access to critical data and can hang or repeatedly crash the service.","category":"other","who_cares":["oracle-ebs","mobile-field-service","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads critical data and crashes the service remotely","analyst_note":"Find Oracle's Critical Patch Update advisory for CVE-2026-101634 and the fixed patch level for 12.2.3-12.2.15; NVD gives no fix.","how_to_check":"Check whether Oracle Mobile Field Service is installed and which E-Business Suite version runs it; the sources do not give a command or file.","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000888,"input_tokens":3139,"output_tokens":1148,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for CVE-2026-101634 and the fixed patch level for 12.2.3-12.2.15; NVD gives no fix.","search":"'-101634':15A,18A '-2026':14A,17A '/av':181C '12.2.15':53B,108C '12.2.3':51B,107C '3.1':169C,180C '9.1':172C 'abil':152C 'access':72B,117C,135C,141C,148C 'affect':105C 'allow':112C 'attack':60B,70B,114C,127C 'avail':175C 'base':170C 'busi':48B,96C 'business':22A 'caus':154C 'complet':140C,161C 'compon':98C 'compromis':121C 'confidenti':173C 'crash':11A,81B,160C 'critic':74B,137C 'cve':13A,16A 'cvss':168C,177C,179C 'data':9A,75B,138C,149C 'dos':162C 'e':21A,47B,95C 'e-busi':46B,94C 'e-business':20A 'easili':109C 'eb':33B 'exploit':110C 'expos':8A 'field':3A,25A,29B,42B,89C,124C,146C,166C 'flaw':7A,56B 'frequent':158C 'give':71B 'h':189C 'h/i':187C 'hang':78B,156C 'host':37B 'http':6A,64B,119C 'impact':176C 'intern':99C 'l/pr':183C 'log':66B 'mobil':2A,28B,41B,88C,123C,145C,165C 'mobile':24A 'mobile-field-servic':27B 'n/a':188C 'n/ac':182C 'n/s':185C 'n/ui':184C 'network':116C 'oper':100C 'oracl':1A,32B,40B,45B,87C,93C,122C,144C,164C 'oracle':19A 'oracle-eb':31B 'product':91C 'reach':62B 'remot':59B 'repeat':80B,159C 'result':132C 'score':171C 'self':36B 'self-host':35B 'servic':4A,12A,30B,43B,83B,90C,125C,147C,167C 'service':26A 'success':69B,126C 'suit':49B,97C 'suite':23A 'support':101C 'u/c':186C 'unauthent':5A,38B,113C 'unauthor':134C,151C 'vector':178C 'vendor':39B 'version':50B,102C 'via':118C 'vulner':84C,111C,130C 'without':65B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101634","severity":null,"published_at":"2026-10-20T22:18:17+00:00","modified_at":"2026-10-21T21:17:34+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101634:372","url":null,"severity":null,"published_at":"2026-10-23T23:07:06+00:00","modified_at":"2026-10-23T23:07:06+00:00","first_seen_at":"2026-10-23T23:07:06+00:00","fetched_at":"2026-10-23T23:07:06+00:00","note":"Oracle CPU Oct 2026 (oracle.com/security-alerts/cpuoct2026.html) lists E-Business Suite 12.2.3-12.2.15; CVSS 9.1 from Oracle. Fix is the Oct 2026 CPU EBS patch; Rapid7 names patch 40022426 (12.2.0 baseline), but I could not read Oracle's MOS patch availability doc (login), so the patch number is secondary-sourced. No exploitation or PoC found (Armis: no KEV, no evidence of exploitation). Did not search social posts; the CVE is 3 days old and the triage note only asked for the fix."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1783,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-101634/","title":"Rapid7: CVE-2026-101634 (solution: Oct 2026 CPU, patch 40022426)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}