---
id: "CVE-2026-101664"
kind: "vulnerability"
aliases: ["CVE-2026-101664"]
title: "Oracle Mobile Field Service: low-privilege HTTP attacker can take over server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle Mobile Field Service (E-Business Suite)", "fixed": ["Oct 2026 CPU patch 40022426"], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["mobile-field-service", "oracle-ebs", "other", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "mobile-field-service-not-installed", "version-outside-12.2.3-12.2.15"]
published_at: "2026-10-20T22:18:20+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-24T00:07:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101664", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:07:15+00:00"}]
---

# Oracle Mobile Field Service: low-privilege HTTP attacker can take over server

Oracle Mobile Field Service, part of Oracle E-Business Suite, has a flaw in its Internal Operations component. An attacker with a low-privilege account and network access over HTTP can take over the service, with full confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Mobile Field Service (E-Business Suite) affected >= 12.2.3, <= 12.2.15 fixed Oct 2026 CPU patch 40022426

## How to check

Check whether your Oracle E-Business Suite is release 12.2.3-12.2.15 and has Mobile Field Service (Internal Operations component) installed. Then check that the Oct 2026 CPU patch is applied (look for 40022426 in AD patch history).

## Fix

Apply the Oracle E-Business Suite October 2026 Critical Patch Update (patch 40022426 for 12.2.0, per Rapid7). Confirm against the EBS patch availability document on My Oracle Support.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101664
- 2026-10-24T00:07:15+00:00 analyst — Oracle October 2026 CPU (2026-10-20) lists EBS 12.2.3-12.2.15; Rapid7 names the fix as EBS CPU patch 40022426 (12.2.0). Oracle's own patch doc is on My Oracle Support (login), so the patch number is from a secondary source. No exploitation or PoC found; not in CISA KEV per Rapid7. Armis page for CVE-2026-101634 describes a different, unauthenticated flaw in the same component; not used.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] Rapid7: CVE-2026-101664 (names EBS CPU patch 40022426) https://www.rapid7.com/db/vulnerabilities/cve-2026-101664/

## From the sources

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_