This vulnerability affects Oracle Field Service within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is classified under CWE-284 (Improper Access Control). The vulnerability is easily exploitable by an attacker with low privileges and network access via HTTP, potentially leading to unauthorized access to critical data and limited unauthorized modification capabilities. The CVSS 3.1 base score is 7.1, reflecting high confidentiality impact and low integrity impact, with no availability impact. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability, nor does it provide a remediation level. Customers are advised to review the advisory and apply patches as they become available.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Field Service. Additionally, attackers may gain unauthorized ability to update, insert, or delete some of the accessible data. The confidentiality impact is high, integrity impact is low, and availability is not affected.

The vendor advisory does not explicitly confirm the availability of a patch or remediation for this vulnerability at this time. Customers should monitor the Oracle Critical Patch Update advisories, particularly the July 2026 update, and apply any relevant patches promptly once released. Until an official fix is confirmed, no specific mitigation steps are provided by the vendor. It is recommended to maintain systems on actively supported versions and apply security patches without delay when available.