CVE-2026-83092

A difficult-to-exploit vulnerability in the Internal Operations component of Oracle Field Service, part of Oracle E-Business Suite, affects versions 12.2.3 through 12.2.15. A low-privileged, authenticated attacker with network access via HTTP can trigger the flaw to compromise Oracle Field Service, gaining the ability to create, delete, or modify critical data (or all Field Service-accessible data), read that data without authorization, and cause a partial denial of service. The issue is rated CVSS 3.1 7.1 (high) because of its significant confidentiality and integrity impacts despite the low availability impact and high attack complexity. Organizations running E-Business Suite 12.2 with the Field Service product deployed are affected, particularly those exposing EBS HTTP endpoints to broader networks. No public proof of concept is known, the flaw is not on CISA's KEV list, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that resolves this issue for Oracle Field Service in E-Business Suite 12.2 (patch to the fixed release per the applicable CPU advisory). Restrict network access to EBS HTTP endpoints, especially Field Service and Internal Operations functionality, to trusted networks or VPN rather than exposing them broadly. Review audit logs for unusual activity by low-privileged Field Service accounts, such as unexpected data creation, modification, or deletion.