This vulnerability affects Oracle Field Service versions 12.2.3 to 12.2.15. It enables an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized access to critical data or complete access to all Oracle Field Service accessible data. Additionally, the attacker can perform unauthorized update, insert, or delete operations on some data and cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact. The vulnerability is publicly known and assigned CVE-2026-83091.

Successful exploitation can lead to unauthorized access to sensitive or critical data within Oracle Field Service, unauthorized modification of some data, and partial denial of service conditions affecting availability. The confidentiality impact is high, while integrity and availability impacts are low. This could compromise business operations relying on Oracle Field Service data and functionality.

Oracle has released this vulnerability as part of its September 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches promptly to affected versions 12.2.3 through 12.2.15 of Oracle Field Service. Oracle recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.