---
id: "CVE-2026-101653"
kind: "vulnerability"
aliases: ["CVE-2026-101653"]
title: "Oracle E-Business Suite Mobile Field Service: low-privilege network takeover"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle Mobile Field Service (E-Business Suite)", "fixed": [], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-e-business-suite", "oracle-mobile-field-service", "package", "vendor"]
not_affected_if: ["product-not-deployed"]
published_at: "2026-10-20T22:18:19+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-24T00:08:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101653", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:08:23+00:00"}]
---

# Oracle E-Business Suite Mobile Field Service: low-privilege network takeover

Oracle Mobile Field Service in E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user with network access over HTTPS can take over the product, reading, changing and disrupting its data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Mobile Field Service (E-Business Suite) affected >= 12.2.3, <= 12.2.15 fixed ?

## How to check

Oracle E-Business Suite 12.2.3-12.2.15 with Mobile Field Service (CSM) installed is affected. Check whether the product is licensed/enabled and which CPU patches are applied (AD/ADOP patch history, or the MOS patch availability doc for the Oct 2026 CPU, EBS section). Exposure needs an authenticated low-privilege user reaching the EBS HTTPS interface.

## Fix

Apply the Oracle E-Business Suite patches from the October 2026 Critical Patch Update, per the EBS patch availability document on My Oracle Support (patch number unknown: MOS login needed). Oracle gives no workaround in the public advisory.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101653
- 2026-10-24T00:08:23+00:00 analyst — Confirmed in Oracle CPU Oct 2026 (cpuoct2026): EBS 12.2.3-12.2.15 affected. Patch number and fixed level are in My Oracle Support patch availability doc (login required), not public; not read. No exploitation or PoC found (not in KEV; Armis/OpenCVE say none reported). Did not search social.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-101653 https://www.cve.org/CVERecord?id=CVE-2026-101653

## From the sources

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_