---
id: "CVE-2026-101634"
kind: "vulnerability"
aliases: ["CVE-2026-101634"]
title: "Oracle Mobile Field Service: unauthenticated HTTP flaw exposes data and crashes service"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle E-Business Suite (Mobile Field Service)", "fixed": ["Oct 2026 CPU patch 40022426 (per Rapid7, unverified on Oracle MOS)"], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["mobile-field-service", "oracle-ebs", "other", "self-hosted", "unauthenticated", "vendor"]
not_affected_if: ["cpu-oct-2026-applied", "mobile-field-service-not-installed"]
published_at: "2026-10-20T22:18:17+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-23T23:07:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101634", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:07:06+00:00"}]
---

# Oracle Mobile Field Service: unauthenticated HTTP flaw exposes data and crashes service

Oracle Mobile Field Service in Oracle E-Business Suite versions 12.2.3 to 12.2.15 has a flaw that a remote attacker can reach over HTTP without logging in. A successful attack gives access to critical data and can hang or repeatedly crash the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle E-Business Suite (Mobile Field Service) affected >= 12.2.3, <= 12.2.15 fixed Oct 2026 CPU patch 40022426 (per Rapid7, unverified on Oracle MOS)

## How to check

Check whether Oracle Mobile Field Service is installed in your EBS 12.2 instance and whether the October 2026 CPU EBS patch is applied (compare against patch 40022426 in OPatch/AD patch history, e.g. ad_applied_patches). Affected: EBS 12.2.3 through 12.2.15. Also check whether the EBS web tier is reachable from the internet.

## Fix

Apply the October 2026 Oracle Critical Patch Update for Oracle E-Business Suite (Rapid7 cites patch 40022426; confirm in Oracle's EBS patch availability document on My Oracle Support). Oracle gives no workaround in the sources read.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101634
- 2026-10-23T23:07:06+00:00 analyst — Oracle CPU Oct 2026 (oracle.com/security-alerts/cpuoct2026.html) lists E-Business Suite 12.2.3-12.2.15; CVSS 9.1 from Oracle. Fix is the Oct 2026 CPU EBS patch; Rapid7 names patch 40022426 (12.2.0 baseline), but I could not read Oracle's MOS patch availability doc (login), so the patch number is secondary-sourced. No exploitation or PoC found (Armis: no KEV, no evidence of exploitation). Did not search social posts; the CVE is 3 days old and the triage note only asked for the fix.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] Rapid7: CVE-2026-101634 (solution: Oct 2026 CPU, patch 40022426) https://www.rapid7.com/db/vulnerabilities/cve-2026-101634/

## From the sources

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Field Service. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_