{"id":"CVE-2026-101653","kind":"vulnerability","aliases":["CVE-2026-101653"],"related":[],"title":"Oracle E-Business Suite Mobile Field Service: low-privilege network takeover","description":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Mobile Field Service in E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user with network access over HTTPS can take over the product, reading, changing and disrupting its data.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Mobile Field Service (E-Business Suite)","fixed":[],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-e-business-suite","oracle-mobile-field-service","package","vendor"],"not_affected_if":["product-not-deployed"],"how_to_check":"Oracle E-Business Suite 12.2.3-12.2.15 with Mobile Field Service (CSM) installed is affected. Check whether the product is licensed/enabled and which CPU patches are applied (AD/ADOP patch history, or the MOS patch availability doc for the Oct 2026 CPU, EBS section). Exposure needs an authenticated low-privilege user reaching the EBS HTTPS interface.","fix":"Apply the Oracle E-Business Suite patches from the October 2026 Critical Patch Update, per the EBS patch availability document on My Oracle Support (patch number unknown: MOS login needed). Oracle gives no workaround in the public advisory.","status":"open","published_at":"2026-10-20T22:18:19+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:38:49+00:00","updated_at":"2026-10-24T00:08:23+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T22:38:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle E-Business Suite Mobile Field Service: low-privilege network takeover","impact":"high","summary":"Oracle Mobile Field Service in E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user with network access over HTTPS can take over the product, reading, changing and disrupting its data.","category":"vendor","who_cares":["oracle-e-business-suite","oracle-mobile-field-service"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over Mobile Field Service, reading and changing its data","analyst_note":"Find the Oracle Critical Patch Update advisory and patch number for E-Business Suite 12.2.3-12.2.15 at https://nvd.nist.gov/vuln/detail/CVE-2026-101653 and confirm the fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["product-not-deployed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000505,"input_tokens":3080,"output_tokens":395,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory and patch number for E-Business Suite 12.2.3-12.2.15 at https://nvd.nist.gov/vuln/detail/CVE-2026-101653 and confirm the fix.","search":"'-101653':16A,19A '-2026':15A,18A '/av':152C '12.2.15':51B,105C '12.2.3':49B,104C '3.1':139C,151C '8.8':142C 'access':67B,115C 'affect':102C 'allow':109C 'attack':112C,125C 'avail':146C 'base':140C 'busi':4A,31B,47B,93C 'business':26A 'chang':76B 'compon':59B,95C 'compromis':119C 'confidenti':143C 'cve':14A,17A 'cvss':138C,148C,150C 'data':80B 'disrupt':78B 'e':3A,25A,30B,46B,92C 'e-busi':2A,45B,91C 'e-business':24A 'easili':106C 'exploit':107C 'field':7A,22A,36B,42B,86C,122C,136C 'flaw':54B 'h':160C 'h/a':159C 'h/i':158C 'https':69B,117C 'impact':147C 'integr':144C 'intern':57B,96C 'l/pr':154C 'l/ui':155C 'low':10A,62B,110C 'low-privileg':9A,61B 'mobil':6A,35B,41B,85C,121C,135C 'mobile':21A 'n/ac':153C 'n/s':156C 'network':12A,66B,114C 'oper':58B,97C 'oracl':1A,29B,34B,40B,84C,90C,120C,134C 'oracle':20A 'oracle-e-business-suit':28B 'oracle-mobile-field-servic':33B 'packag':38B 'privileg':11A,63B,111C 'product':74B,88C 'read':75B 'result':130C 'score':141C 'servic':8A,37B,43B,87C,123C,137C 'service':23A 'success':124C 'suit':5A,32B,48B,94C 'suite':27A 'support':98C 'take':71B 'takeov':13A,132C 'u/c':157C 'user':64B 'vector':149C 'vendor':39B 'version':99C 'via':116C 'vulner':81C,108C,128C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101653","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101653","severity":null,"published_at":"2026-10-20T22:18:19+00:00","modified_at":"2026-10-21T19:16:54+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101653:593","url":null,"severity":null,"published_at":"2026-10-24T00:08:23+00:00","modified_at":"2026-10-24T00:08:23+00:00","first_seen_at":"2026-10-24T00:08:23+00:00","fetched_at":"2026-10-24T00:08:23+00:00","note":"Confirmed in Oracle CPU Oct 2026 (cpuoct2026): EBS 12.2.3-12.2.15 affected. Patch number and fixed level are in My Oracle Support patch availability doc (login required), not public; not read. No exploitation or PoC found (not in KEV; Armis/OpenCVE say none reported). Did not search social."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2372,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101653","title":"CVE Record: CVE-2026-101653","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}