This vulnerability affects Oracle Field Service versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product by leveraging a flaw that requires user interaction. Successful exploitation can lead to unauthorized update, insert, or delete access to some Oracle Field Service accessible data, as well as unauthorized read access to a subset of that data. The vulnerability impacts confidentiality and integrity but not availability. The attack scope may extend beyond Oracle Field Service to other Oracle products. Oracle has published a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability among 673 security patches across multiple products. Customers are strongly advised to apply the available patches promptly to mitigate this risk.

The vulnerability allows unauthorized modification (update, insert, delete) and limited unauthorized reading of Oracle Field Service accessible data. This compromises data confidentiality and integrity but does not affect availability. The requirement for user interaction limits the ease of exploitation. The vulnerability may also impact additional Oracle products beyond Oracle Field Service due to scope change.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers using Oracle Field Service versions 12.2.3 through 12.2.15 should apply the relevant patches without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates to prevent exploitation. No indication of alternative mitigations or 'no action required' was provided by the vendor advisory.