CVE-2026-101634
CriticalCVSS 9.1Summary
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can easily exploit it to gain unauthorized access to critical data and cause a hang or frequently repeatable crash (DoS).
Risk Assessment
A CVSS 9.1 score indicates serious risk of confidentiality and availability breaches. The attack requires no authentication and can be performed remotely, causing service disruptions.
Recommendation
Promptly install Oracle updates for Oracle E-Business Suite. Restrict access to the Internal Operations component and monitor service availability.
Other vulnerabilities in Oracle E-Business Suite
See all- CVE-2026-91496High
Vulnerability in the Workflow Notification Mailer component of Oracle E-Business Suite Workflow. A low privileged attacker can exploit it over the network via HTTP to take over Workflow; exploitation is difficult. CVSS 7.5.
- CVE-2026-101809Critical
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer) affecting versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can easily exploit it to compromise Workflow, potentially impacting other products.
- CVE-2026-101808Critical
Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI) affecting versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can easily exploit it to gain unauthorized creation, deletion, or modification access to critical data.
- CVE-2026-101767Critical
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core) affecting versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle Application Object Library.
- CVE-2026-62549Critical
Vulnerability in Oracle HRMS (UK) (component: UK Payroll) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise the system, leading to unauthorized creation, deletion, or modification of critical data and access to all Oracle HRMS (UK) data. Scope change impacts additional products.
- CVE-2026-46817CriticalActively exploited
Critical vulnerability in Oracle Payments (Oracle E-Business Suite) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can fully compromise the system without any privileges.
- CVE-2025-62481Critical
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration) affecting versions 12.2.3-12.2.14. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing (CVSS 9.8).
- CVE-2025-53072Critical
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration) affecting versions 12.2.3-12.2.14. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing (CVSS 9.8).
- CVE-2026-83428High
Vulnerability in Oracle Demand Signal Repository (Oracle E-Business Suite), component Internal Operations, affecting versions 12.2.3-12.2.15. A low-privileged authenticated attacker with HTTP network access can gain unauthorized access to data and create, delete, or modify data. CVSS 3.1 Base Score 8.1.
- CVE-2026-83425High
Vulnerability in Oracle Complex Maintenance, Repair and Overhaul (Oracle E-Business Suite), component Internal Operations, affecting versions 12.2.12-12.2.15. A low-privileged authenticated attacker with HTTP network access can access critical data and cause a partial denial of service. CVSS 3.1 Base Score 8.5.
Original NVD description (English source)
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Field Service. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS