This vulnerability in Oracle Field Service (versions 12.2.3 to 12.2.15) allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes across multiple products including Oracle E-Business Suite.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Field Service. The confidentiality of sensitive information is at high risk, while integrity and availability are not impacted according to the CVSS vector. This could compromise sensitive business operations relying on Oracle Field Service data.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.