{"id":"CVE-2026-101664","kind":"vulnerability","aliases":["CVE-2026-101664"],"related":[],"title":"Oracle Mobile Field Service: low-privilege HTTP attacker can take over server","description":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Mobile Field Service, part of Oracle E-Business Suite, has a flaw in its Internal Operations component. An attacker with a low-privilege account and network access over HTTP can take over the service, with full confidentiality, integrity and availability impact.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Mobile Field Service (E-Business Suite)","fixed":["Oct 2026 CPU patch 40022426"],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["mobile-field-service","oracle-ebs","other","self-hosted","vendor"],"not_affected_if":["auth-required","mobile-field-service-not-installed","version-outside-12.2.3-12.2.15"],"how_to_check":"Check whether your Oracle E-Business Suite is release 12.2.3-12.2.15 and has Mobile Field Service (Internal Operations component) installed. Then check that the Oct 2026 CPU patch is applied (look for 40022426 in AD patch history).","fix":"Apply the Oracle E-Business Suite October 2026 Critical Patch Update (patch 40022426 for 12.2.0, per Rapid7). Confirm against the EBS patch availability document on My Oracle Support.","status":"open","published_at":"2026-10-20T22:18:20+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:38:49+00:00","updated_at":"2026-10-24T00:07:15+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:38:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Mobile Field Service: low-privilege HTTP attacker can take over server","impact":"high","summary":"Oracle Mobile Field Service, part of Oracle E-Business Suite, has a flaw in its Internal Operations component. An attacker with a low-privilege account and network access over HTTP can take over the service, with full confidentiality, integrity and availability impact.","category":"other","who_cares":["oracle-ebs","mobile-field-service","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over the service over HTTP with a low-privilege account","analyst_note":"Find the Oracle security advisory that names the fixed patch for 12.2.3-12.2.15; the sources give only NVD and do not name a fix.","how_to_check":"Check whether your Oracle E-Business Suite release includes Mobile Field Service and falls within 12.2.3 to 12.2.15.","needs_analyst":true,"not_affected_if":["version-outside-12.2.3-12.2.15","mobile-field-service-not-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001003,"input_tokens":3080,"output_tokens":1390,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle security advisory that names the fixed patch for 12.2.3-12.2.15; the sources give only NVD and do not name a fix.","search":"'-101664':16A,19A '-2026':15A,18A '/av':155C '12.2.15':108C '12.2.3':107C '3.1':142C,154C '8.8':145C 'access':69B,118C 'account':66B 'affect':105C 'allow':112C 'attack':9A,60B,115C,128C 'avail':82B,149C 'base':143C 'busi':49B,96C 'business':26A 'compon':58B,98C 'compromis':122C 'confidenti':79B,146C 'cve':14A,17A 'cvss':141C,151C,153C 'e':25A,48B,95C 'e-busi':47B,94C 'e-business':24A 'easili':109C 'eb':34B 'exploit':110C 'field':3A,22A,30B,42B,89C,125C,139C 'flaw':53B 'full':78B 'h':163C 'h/a':162C 'h/i':161C 'host':38B 'http':8A,71B,120C 'impact':83B,150C 'integr':80B,147C 'intern':56B,99C 'l/pr':157C 'l/ui':158C 'low':6A,64B,113C 'low-privileg':5A,63B 'mobil':2A,29B,41B,88C,124C,138C 'mobile':21A 'mobile-field-servic':28B 'n/ac':156C 'n/s':159C 'network':68B,117C 'oper':57B,100C 'oracl':1A,33B,40B,46B,87C,93C,123C,137C 'oracle':20A 'oracle-eb':32B 'part':44B 'privileg':7A,65B,114C 'product':91C 'result':133C 'score':144C 'self':37B 'self-host':36B 'server':13A 'servic':4A,31B,43B,76B,90C,126C,140C 'service':23A 'success':127C 'suit':50B,97C 'suite':27A 'support':101C 'take':11A,73B 'takeov':135C 'u/c':160C 'vector':152C 'vendor':39B 'version':102C 'via':119C 'vulner':84C,111C,131C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101664","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101664","severity":null,"published_at":"2026-10-20T22:18:20+00:00","modified_at":"2026-10-21T19:16:54+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101664:589","url":null,"severity":null,"published_at":"2026-10-24T00:07:15+00:00","modified_at":"2026-10-24T00:07:15+00:00","first_seen_at":"2026-10-24T00:07:15+00:00","fetched_at":"2026-10-24T00:07:15+00:00","note":"Oracle October 2026 CPU (2026-10-20) lists EBS 12.2.3-12.2.15; Rapid7 names the fix as EBS CPU patch 40022426 (12.2.0). Oracle's own patch doc is on My Oracle Support (login), so the patch number is from a secondary source. No exploitation or PoC found; not in CISA KEV per Rapid7. Armis page for CVE-2026-101634 describes a different, unauthenticated flaw in the same component; not used."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2361,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-101664/","title":"Rapid7: CVE-2026-101664 (names EBS CPU patch 40022426)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}