---
id: "CVE-2026-101654"
kind: "vulnerability"
aliases: ["CVE-2026-101654"]
title: "Oracle Mobile Field Service: low-privilege network attacker can take over product"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle Mobile Field Service (E-Business Suite)", "fixed": [], "affected": ">= 12.2.3, <= 12.2.15 without October 2026 CPU patches", "ecosystem": "vendor"}]
ecosystems: []
tags: ["enterprise", "oracle-ebs", "oracle-mobile-field-service", "package", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting", "not-using-mobile-field-service", "unknown"]
published_at: "2026-10-20T22:18:19+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-24T00:07:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101654", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:07:21+00:00"}]
---

# Oracle Mobile Field Service: low-privilege network attacker can take over product

Oracle Mobile Field Service (E-Business Suite 12.2.3-12.2.15), Internal Operations component: a low-privileged user with HTTPS network access can take over the product (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N, C/I/A high). Fixed by Oracle's October 2026 Critical Patch Update. Not in CISA KEV; no exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Mobile Field Service (E-Business Suite) affected >= 12.2.3, <= 12.2.15 without October 2026 CPU patches fixed ?

## How to check

You are exposed if you run Oracle E-Business Suite 12.2.3 through 12.2.15 with Oracle Mobile Field Service installed and the October 2026 CPU EBS patches not applied. Check installed patches with AD/OPatch-style patch history (adop/ad_bugs) against the patch list in the MOS EBS October 2026 CPU patch availability document (see MOS Article KA923 for the latest EBS CPU). Also check whether the Mobile Field Service (CSM) product is licensed and its HTTPS endpoints are reachable.

## Fix

Apply the Oracle E-Business Suite patches from the October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html; patch numbers are in the MOS EBS patch availability document, MOS KA923 points to the latest). No fixed-version number is published, since EBS is patched by patch set. No workaround found. Until patched, restrict network access to EBS external/mobile endpoints.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101654
- 2026-10-24T00:07:21+00:00 analyst — Triage pointer was wrong: CVE published 2026-10-20, so it belongs to Oracle's October 2026 CPU, not April. CPU page lists EBS 12.2.3-12.2.15 but exact patch numbers are in the MOS EBS patch availability doc (login needed; not read). No exploitation or KEV; no public PoC found; social search not done (no CVE-id chatter expected).

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-101654 https://www.cve.org/CVERecord?id=CVE-2026-101654

## From the sources

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_