An easily exploitable flaw in Oracle Mobile Field Service, part of Oracle E-Business Suite, lets an unauthenticated attacker with network access read critical data and crash the application (CVSS 3.1 9.1, Critical).
What Is It
CVE-2026-101634 is in the Internal Operations component of Oracle Mobile Field Service, a product in Oracle E-Business Suite. Oracle describes it as "easily exploitable." An attacker needs only network access over HTTP to use it. They do not need credentials and no user has to do anything.
If the attack works, the attacker can get unauthorized access to critical data, or complete access to all data that Oracle Mobile Field Service can reach. The attacker can also cause a hang or a frequently repeatable crash, which Oracle rates as a complete denial of service.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact: High confidentiality, no integrity, high availability
Why It Matters
The flaw needs no login, no user interaction and little attacker skill. Any unpatched instance running an affected version (12.2.3 through 12.2.15) that attackers can reach over HTTP is therefore exposed. It scores 9.1 (Critical), with an exploitability subscore of 3.9 and an impact subscore of 5.2. E-Business Suite deployments often hold sensitive operational and business data. A successful attack could expose all data the Mobile Field Service module can reach and also take the service offline.
The supplied CISA KEV entry is empty, so KEV does not currently confirm active exploitation. The NVD record was published on 2026-10-20 with status "Received," which means NVD has not yet completed its own analysis. Watch the KEV catalog for changes.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Mobile Field Service (Oracle E-Business Suite)
- Component: Internal Operations
- Affected supported versions: 12.2.3 through 12.2.15
The NVD record does not yet list any CPE entries.
Patch Status
The only reference in the NVD record is Oracle's October 2026 Critical Patch Update advisory, and Oracle is the source of the CVE. Administrators running E-Business Suite 12.2.3–12.2.15 with Mobile Field Service should check that advisory for the fix and apply it. Until the patch is in place, limit HTTP access to these instances to trusted networks.
There is no CISA KEV entry, so no federal remediation deadline or required action applies at this time.
Sources
- Oracle Critical Patch Update Advisory – October 2026
- NVD – CVE-2026-101634
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)