This vulnerability in Oracle Field Service allows an attacker with low privileges and network access over HTTP to compromise the product. The scope of impact may extend to additional Oracle products due to shared components or integrations. Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible through Oracle Field Service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. The vulnerability affects Oracle Field Service versions 12.2.3 through 12.2.15. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous security fixes across Oracle products.

Exploitation of this vulnerability can lead to unauthorized access to critical or all data accessible via Oracle Field Service. This compromises confidentiality but does not affect integrity or availability. The vulnerability is easily exploitable by an attacker with low privileges and network access via HTTP. The scope of impact may extend beyond Oracle Field Service to other integrated Oracle products.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Field Service versions 12.2.3 through 12.2.15 should apply the relevant patches promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.