A vulnerability exists in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data, perform unauthorized data modifications, and cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 7.6, indicating high severity. Oracle has released security patches addressing this and many other vulnerabilities in their September 2026 Critical Security Patch Update.