---
id: "CVE-2026-101655"
kind: "vulnerability"
aliases: ["CVE-2026-101655"]
title: "Oracle E-Business Suite Mobile Field Service: low-privilege network attacker can take over"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle Mobile Field Service (E-Business Suite)", "fixed": [], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-ebs", "oracle-mobile-field-service", "other", "self-hosted", "vendor"]
not_affected_if: ["mobile-field-service-not-installed", "outside-12.2.3-12.2.15"]
published_at: "2026-10-20T22:18:19+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-24T00:07:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101655", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:07:08+00:00"}]
---

# Oracle E-Business Suite Mobile Field Service: low-privilege network attacker can take over

Oracle Mobile Field Service, part of Oracle E-Business Suite, has a flaw in its Internal Operations component that is reachable over HTTP. An attacker with low-privilege access can take over the service, with high impact to confidentiality, integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Mobile Field Service (E-Business Suite) affected >= 12.2.3, <= 12.2.15 fixed ?

## How to check

Run Oracle EBS 12.2.x (12.2.3-12.2.15) with Mobile Field Service (CSM/Internal Operations) installed? Compare your applied patches against the October 2026 CPU EBS patch availability document on My Oracle Support (via the link in the CPU page's Oracle E-Business Suite row).

## Fix

Apply the October 2026 Critical Patch Update for Oracle E-Business Suite (patch numbers in the MOS patch availability document; not public). Until applied, limit network access to EBS HTTP endpoints.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101655
- 2026-10-24T00:07:08+00:00 analyst — Oracle October 2026 CPU lists EBS 12.2.3-12.2.15 as affected; per-patch numbers sit in the My Oracle Support patch availability doc (login needed), so exact patch ID unknown. No exploitation or PoC found; no X search done.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE-2026-101655 | Tenable https://www.tenable.com/cve/CVE-2026-101655

## From the sources

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_