{"id":"CVE-2026-101656","kind":"vulnerability","aliases":["CVE-2026-101656"],"related":[],"title":"Oracle Mobile Field Service: low-privilege network attacker can take over the product","description":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Mobile Field Service in Oracle E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. An attacker with a low-privilege account and HTTPS network access can fully take over the product, with high confidentiality, integrity and availability impact.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Mobile Field Service","fixed":[],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["enterprise","oracle-ebs","oracle-mobile-field-service","other","self-hosted","vendor"],"not_affected_if":["managed-hosting","mobile-field-service-not-installed","outside-12.2.3-12.2.15"],"how_to_check":"Check whether you run Oracle E-Business Suite 12.2.3-12.2.15 with Mobile Field Service (Oracle Field Service) installed and enabled, and whether the Oct 2026 CPU EBS patches are applied. Check the patch level with the AD/ADOP patch history on the EBS apps tier, comparing against the MOS patch availability document.","fix":"Apply the Oracle October 2026 Critical Patch Update for Oracle E-Business Suite 12.2.3-12.2.15, following the E-Business Suite patch availability document linked from the advisory (My Oracle Support). Specific patch number/version unknown; needs MOS access.","status":"open","published_at":"2026-10-20T22:18:19+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:38:48+00:00","updated_at":"2026-10-24T00:07:21+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:38:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Mobile Field Service: low-privilege network attacker can take over the product","impact":"high","summary":"Oracle Mobile Field Service in Oracle E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. An attacker with a low-privilege account and HTTPS network access can fully take over the product, with high confidentiality, integrity and availability impact.","category":"other","who_cares":["oracle-ebs","oracle-mobile-field-service","enterprise"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over the product, reading and changing its data","analyst_note":"Find the Oracle Critical Patch Update advisory for this CVE and confirm the patch or fixed version; the sources give no fix.","how_to_check":"Check whether your Oracle E-Business Suite Mobile Field Service is in the affected range 12.2.3-12.2.15. The exact check command or setting is unknown.","needs_analyst":true,"not_affected_if":["outside-12.2.3-12.2.15"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000969,"input_tokens":3084,"output_tokens":1321,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory for this CVE and confirm the patch or fixed version; the sources give no fix.","search":"'-101656':17A,20A '-2026':16A,19A '/av':157C '12.2.15':52B,110C '12.2.3':50B,109C '3.1':144C,156C '8.8':147C 'access':72B,120C 'account':68B 'affect':107C 'allow':114C 'attack':9A,62B,117C,130C 'avail':84B,151C 'base':145C 'busi':47B,98C 'compon':60B,100C 'compromis':124C 'confidenti':81B,148C 'cve':15A,18A 'cvss':143C,153C,155C 'e':46B,97C 'e-busi':45B,96C 'easili':111C 'eb':28B 'enterpris':25B 'exploit':112C 'field':3A,23A,32B,41B,91C,127C,141C 'flaw':55B 'fulli':74B 'h':165C 'h/a':164C 'h/i':163C 'high':80B 'host':37B 'https':70B,122C 'impact':85B,152C 'integr':82B,149C 'intern':58B,101C 'l/pr':159C 'l/ui':160C 'low':6A,66B,115C 'low-privileg':5A,65B 'mobil':2A,31B,40B,90C,126C,140C 'mobile':22A 'n/ac':158C 'n/s':161C 'network':8A,71B,119C 'oper':59B,102C 'oracl':1A,27B,30B,39B,44B,89C,95C,125C,139C 'oracle':21A 'oracle-eb':26B 'oracle-mobile-field-servic':29B 'privileg':7A,67B,116C 'product':14A,78B,93C 'result':135C 'score':146C 'self':36B 'self-host':35B 'servic':4A,33B,42B,92C,128C,142C 'service':24A 'success':129C 'suit':48B,99C 'support':103C 'take':11A,75B 'takeov':137C 'u/c':162C 'vector':154C 'vendor':38B 'version':49B,104C 'via':121C 'vulner':86C,113C,133C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101656","severity":null,"published_at":"2026-10-20T22:18:19+00:00","modified_at":"2026-10-21T19:16:54+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101656:590","url":null,"severity":null,"published_at":"2026-10-24T00:07:21+00:00","modified_at":"2026-10-24T00:07:21+00:00","first_seen_at":"2026-10-24T00:07:21+00:00","fetched_at":"2026-10-24T00:07:21+00:00","note":"Confirmed in Oracle CPU Oct 2026 (cpuoct2026) and CVE record: EBS 12.2.3-12.2.15, CVSS 8.8 from Oracle. Oracle gives no fixed version; fix is the Oct 2026 CPU patch via the E-Business Suite patch availability document on My Oracle Support (login needed, not read). No exploitation or PoC found; not in KEV. Did not search social posts. Separate sibling GHSA-74p6-4459-pqp3 (Admin UI, 7.4) is a different CVE."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2366,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101656","title":"CVE Record: CVE-2026-101656","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}