Executive brief
Oracle Field Service is a component of Oracle E-Business Suite used to manage mobile field operations and service delivery. This vulnerability allows low-privilege users with network access to illegally create, modify, or delete critical business data, access sensitive information, and temporarily disrupt service availability. The attack is complex to execute but carries significant risk to data integrity and system availability for organizations relying on field service operations.
Technical details
This is a privilege escalation and data manipulation vulnerability in Oracle Field Service (E-Business Suite component: Internal Operations) affecting versions 12.2.3 through 12.2.15. The vulnerability allows a low-privileged, network-accessible attacker via HTTP to perform unauthorized CRUD operations on critical data and cause partial denial of service. The attack vector is network-based with high complexity (AC:H) and requires low privileges (PR:L) but no user interaction. Exploitation results in confidentiality, integrity, and availability impacts. Patch availability or mitigation guidance should be obtained from Oracle's security advisories.
Affected products
- Oracle E-Business Suite Field Service 12.2.3 through 12.2.15
Timeline
- 2026-09-15: disclosed