This vulnerability in Oracle Field Service (component: Internal Operations) affects supported versions 12.2.3 to 12.2.15. It is difficult to exploit and requires network access via HTTP with low privileges. If exploited, it can result in unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Field Service, unauthorized access to all accessible data, and the ability to cause a partial denial of service. This impacts confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 7.1.

Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the Oracle advisory. No indication of 'no action required' or 'already mitigated' is present.