CVE-2026-83091

CVE-2026-83091 is a high-severity (CVSS 3.1: 7.6) vulnerability in the Internal Operations component of Oracle Field Service, part of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It is easily exploitable by a low-privileged (authenticated) attacker with network access via HTTP, requiring no user interaction. A successful attack lets the attacker read critical data or all Oracle Field Service accessible data, gain unauthorized update, insert, or delete access to some of that data, and cause a partial denial of service of the Field Service component. Organizations running the affected E-Business Suite releases with the Field Service product enabled are at risk, particularly if EBS web endpoints are reachable by low-trust users. No public proof-of-concept exists and the flaw is not on the CISA KEV list, so exploitation is currently unknown.

What to do: Apply the Oracle Critical Patch Update that addresses this issue to all Oracle E-Business Suite 12.2.3-12.2.15 environments running Field Service, following the patch specifics in Oracle's CPU advisory. Restrict HTTP access to EBS/Field Service pages to trusted networks or VPN, enforce least-privilege on Field Service responsibilities, and audit recent activity for unauthorized data reads, modifications, or deletions.