{"id":"CVE-2026-101655","kind":"vulnerability","aliases":["CVE-2026-101655"],"related":[],"title":"Oracle E-Business Suite Mobile Field Service: low-privilege network attacker can take over","description":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Mobile Field Service, part of Oracle E-Business Suite, has a flaw in its Internal Operations component that is reachable over HTTP. An attacker with low-privilege access can take over the service, with high impact to confidentiality, integrity and availability.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Mobile Field Service (E-Business Suite)","fixed":[],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-ebs","oracle-mobile-field-service","other","self-hosted","vendor"],"not_affected_if":["mobile-field-service-not-installed","outside-12.2.3-12.2.15"],"how_to_check":"Run Oracle EBS 12.2.x (12.2.3-12.2.15) with Mobile Field Service (CSM/Internal Operations) installed? Compare your applied patches against the October 2026 CPU EBS patch availability document on My Oracle Support (via the link in the CPU page's Oracle E-Business Suite row).","fix":"Apply the October 2026 Critical Patch Update for Oracle E-Business Suite (patch numbers in the MOS patch availability document; not public). Until applied, limit network access to EBS HTTP endpoints.","status":"open","published_at":"2026-10-20T22:18:19+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:38:48+00:00","updated_at":"2026-10-24T00:07:08+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:38:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown; the sources list affected versions 12.2.3 through 12.2.15, but name no patched version","reach":"network","title":"Oracle E-Business Suite Mobile Field Service: low-privilege network attacker can take over","impact":"high","summary":"Oracle Mobile Field Service, part of Oracle E-Business Suite, has a flaw in its Internal Operations component that is reachable over HTTP. An attacker with low-privilege access can take over the service, with high impact to confidentiality, integrity and availability.","category":"other","who_cares":["oracle-ebs","oracle-mobile-field-service","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker takes over the service; confidentiality, integrity and availability all lost","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["outside-12.2.3-12.2.15"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000877,"input_tokens":3078,"output_tokens":1138,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE to get the patch version and check steps; the NVD entry gives none.","search":"'-101655':18A,21A '-2026':17A,20A '/av':158C '12.2.15':111C '12.2.3':110C '3.1':145C,157C '8.8':148C 'access':73B,121C 'affect':108C 'allow':115C 'attack':13A,68B,118C,131C 'avail':86B,152C 'base':146C 'busi':4A,52B,99C 'business':28A 'compon':61B,101C 'compromis':125C 'confidenti':83B,149C 'cve':16A,19A 'cvss':144C,154C,156C 'e':3A,27A,51B,98C 'e-busi':2A,50B,97C 'e-business':26A 'easili':112C 'eb':32B 'exploit':113C 'field':7A,24A,36B,45B,92C,128C,142C 'flaw':56B 'h':166C 'h/a':165C 'h/i':164C 'high':80B 'host':41B 'http':66B,123C 'impact':81B,153C 'integr':84B,150C 'intern':59B,102C 'l/pr':160C 'l/ui':161C 'low':10A,71B,116C 'low-privileg':9A,70B 'mobil':6A,35B,44B,91C,127C,141C 'mobile':23A 'n/ac':159C 'n/s':162C 'network':12A,120C 'oper':60B,103C 'oracl':1A,31B,34B,43B,49B,90C,96C,126C,140C 'oracle':22A 'oracle-eb':30B 'oracle-mobile-field-servic':33B 'part':47B 'privileg':11A,72B,117C 'product':94C 'reachabl':64B 'result':136C 'score':147C 'self':40B 'self-host':39B 'servic':8A,37B,46B,78B,93C,129C,143C 'service':25A 'success':130C 'suit':5A,53B,100C 'suite':29A 'support':104C 'take':15A,75B 'takeov':138C 'u/c':163C 'vector':155C 'vendor':42B 'version':105C 'via':122C 'vulner':87C,114C,134C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101655","severity":null,"published_at":"2026-10-20T22:18:19+00:00","modified_at":"2026-10-21T19:16:54+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101655:591","url":null,"severity":null,"published_at":"2026-10-24T00:07:08+00:00","modified_at":"2026-10-24T00:07:08+00:00","first_seen_at":"2026-10-24T00:07:08+00:00","fetched_at":"2026-10-24T00:07:08+00:00","note":"Oracle October 2026 CPU lists EBS 12.2.3-12.2.15 as affected; per-patch numbers sit in the My Oracle Support patch availability doc (login needed), so exact patch ID unknown. No exploitation or PoC found; no X search done."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2359,"url":"https://www.tenable.com/cve/CVE-2026-101655","title":"CVE-2026-101655 | Tenable","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}