{"id":"CVE-2026-101634","published":"2026-10-20T22:18:17Z","modified":"2026-10-21T21:17:34Z","title":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations)","vendor":"Oracle Corporation","product":"Oracle Mobile Field Service","tier":"core","eol":null,"description":{"text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Field Service. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).","provenance":"source","from":"NVD"},"summary":{"text":"A vulnerability in the Internal Operations component of Oracle Mobile Field Service, part of Oracle E-Business Suite, affects supported versions 12.2.3 through 12.2.15. An unauthenticated remote attacker with network access over HTTP, requiring no user interaction and no special configuration, can gain unauthorized access to critical data or all data accessible through the product, and can cause a hang or repeatable crash that denies service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:18:44Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00561,"percentile":0.46593,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":6,"pulses":[{"name":"Known_Cve | Oct 29, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ae20c23cd267c7cddd4e545","created":"2026-10-28"},{"name":"Known_Cve | Oct 28, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ae0ba88997d8920e9952075","created":"2026-10-27"},{"name":"Known_Cve | Oct 27, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6adf68beabc3bad24a2b7cc6","created":"2026-10-26"},{"name":"Known_Cve | Oct 24, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6adb741adaae4be68dd04fea","created":"2026-10-23"},{"name":"Known_Cve | Oct 23, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ada237de8198eb6a6cbfac4","created":"2026-10-22"},{"name":"Known_Cve | Oct 22, 2026 | Part 4/4","url":"https://otx.alienvault.com/pulse/6ad8d3528b43fc2ec5b04a43","created":"2026-10-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-106042","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-106042","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-20","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101634","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":17.6,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":9.32,"detail":"percentile 0.4659"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}