---
id: "CVE-2026-101656"
kind: "vulnerability"
aliases: ["CVE-2026-101656"]
title: "Oracle Mobile Field Service: low-privilege network attacker can take over the product"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle Mobile Field Service", "fixed": [], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["enterprise", "oracle-ebs", "oracle-mobile-field-service", "other", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting", "mobile-field-service-not-installed", "outside-12.2.3-12.2.15"]
published_at: "2026-10-20T22:18:19+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-24T00:07:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101656", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:07:21+00:00"}]
---

# Oracle Mobile Field Service: low-privilege network attacker can take over the product

Oracle Mobile Field Service in Oracle E-Business Suite versions 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. An attacker with a low-privilege account and HTTPS network access can fully take over the product, with high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Mobile Field Service affected >= 12.2.3, <= 12.2.15 fixed ?

## How to check

Check whether you run Oracle E-Business Suite 12.2.3-12.2.15 with Mobile Field Service (Oracle Field Service) installed and enabled, and whether the Oct 2026 CPU EBS patches are applied. Check the patch level with the AD/ADOP patch history on the EBS apps tier, comparing against the MOS patch availability document.

## Fix

Apply the Oracle October 2026 Critical Patch Update for Oracle E-Business Suite 12.2.3-12.2.15, following the E-Business Suite patch availability document linked from the advisory (My Oracle Support). Specific patch number/version unknown; needs MOS access.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101656
- 2026-10-24T00:07:21+00:00 analyst — Confirmed in Oracle CPU Oct 2026 (cpuoct2026) and CVE record: EBS 12.2.3-12.2.15, CVSS 8.8 from Oracle. Oracle gives no fixed version; fix is the Oct 2026 CPU patch via the E-Business Suite patch availability document on My Oracle Support (login needed, not read). No exploitation or PoC found; not in KEV. Did not search social posts. Separate sibling GHSA-74p6-4459-pqp3 (Admin UI, 7.4) is a different CVE.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-101656 https://www.cve.org/CVERecord?id=CVE-2026-101656

## From the sources

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_