{"id":"CVE-2026-101694","kind":"vulnerability","aliases":["CVE-2026-101694"],"related":[],"title":"Oracle E-Business Suite Mobile Field Service: Admin UI flaw enables full takeover","description":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"An Admin UI component of Oracle Mobile Field Service, part of Oracle E-Business Suite, has a flaw that a high-privileged attacker can reach over the network via HTTPS. Successful exploitation lets the attacker take over the Mobile Field Service product, with high impact to confidentiality, integrity and availability.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise","mobile-field-service","oracle-ebs","self-hosted","vendor"],"not_affected_if":["feature-not-deployed","version-outside-range"],"how_to_check":"- Check the installed Oracle E-Business Suite release and Mobile Field Service patch level against the affected range `12.2.3`-`12.2.15`\n- unknown for other checks: the sources do not give a file, setting or command to inspect","fix":"- Apply the Oracle Critical Patch Update fix for Oracle Mobile Field Service in Oracle E-Business Suite; the sources do not name the patch number or target version\n- unknown for further steps: the sources do not say","status":"open","published_at":"2026-10-20T22:18:23+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:29:14+00:00","updated_at":"2026-10-25T03:29:14+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:29:14Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle Mobile Field Service in Oracle E-Business Suite; the sources do not name the patch number or target version\n- unknown for further steps: the sources do not say","reach":"network","title":"Oracle E-Business Suite Mobile Field Service: Admin UI flaw enables full takeover","impact":"high","summary":"An Admin UI component of Oracle Mobile Field Service, part of Oracle E-Business Suite, has a flaw that a high-privileged attacker can reach over the network via HTTPS. Successful exploitation lets the attacker take over the Mobile Field Service product, with high impact to confidentiality, integrity and availability.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","mobile-field-service","self-hosted","enterprise"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over Mobile Field Service, reading and changing its data","analyst_note":"Find Oracle's advisory and patch number for CVE-2026-101694 in the Oracle Critical Patch Update notes; NVD entry has no fix version.","how_to_check":"- Check the installed Oracle E-Business Suite release and Mobile Field Service patch level against the affected range `12.2.3`-`12.2.15`\n- unknown for other checks: the sources do not give a file, setting or command to inspect","needs_analyst":true,"not_affected_if":["version-outside-range","feature-not-deployed"],"who_is_affected":"Teams running Oracle E-Business Suite with Oracle Mobile Field Service in the supported range `12.2.3`-`12.2.15` are affected, with the Admin UI reachable over HTTPS. Exposure depends on whether the Admin UI is reachable from the network and on who holds high-privilege accounts. Teams on other versions or without Mobile Field Service can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000695,"input_tokens":3461,"output_tokens":698,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101694':17A,20A '-2026':16A,19A '/av':156C '12.2.15':109C '12.2.3':108C '3.1':143C,155C '7.2':146C 'access':119C 'admin':9A,34B,100C 'affect':106C 'allow':113C 'attack':57B,69B,116C,129C 'avail':84B,150C 'base':144C 'busi':4A,47B,97C 'compon':36B,99C 'compromis':123C 'confidenti':81B,147C 'cve':15A,18A 'cvss':142C,152C,154C 'e':3A,46B,96C 'e-busi':2A,45B,95C 'easili':110C 'eb':28B 'enabl':12A 'enterpris':21B 'exploit':66B,111C 'field':7A,24B,40B,74B,90C,126C,140C 'flaw':11A,51B 'full':13A 'h':164C 'h/a':163C 'h/i':162C 'h/ui':159C 'high':55B,78B,114C 'high-privileg':54B 'host':31B 'https':64B,121C 'impact':79B,151C 'integr':82B,148C 'l/pr':158C 'let':67B 'mobil':6A,23B,39B,73B,89C,125C,139C 'mobile-field-servic':22B 'n/ac':157C 'n/s':160C 'network':62B,118C 'oracl':1A,27B,38B,44B,88C,94C,124C,138C 'oracle-eb':26B 'part':42B 'privileg':56B,115C 'product':76B,92C 'reach':59B 'result':134C 'score':145C 'self':30B 'self-host':29B 'servic':8A,25B,41B,75B,91C,127C,141C 'success':65B,128C 'suit':5A,48B,98C 'support':102C 'take':70B 'takeov':14A,136C 'u/c':161C 'ui':10A,35B,101C 'vector':153C 'vendor':32B 'version':103C 'via':63B,120C 'vulner':85C,112C,132C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle E-Business Suite with Oracle Mobile Field Service in the supported range `12.2.3`-`12.2.15` are affected, with the Admin UI reachable over HTTPS. Exposure depends on whether the Admin UI is reachable from the network and on who holds high-privilege accounts. Teams on other versions or without Mobile Field Service can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101694","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101694","severity":null,"published_at":"2026-10-20T22:18:23+00:00","modified_at":"2026-10-22T16:17:12+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}