EUVD-2026-106227
GHSA-655m-cg25-p692
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege EBS account
-
ExploitSend crafted HTTP request to MWA Terminal Server
-
ExecutionExploit flaw to access restricted data
-
ImpactExfiltrate critical application data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged Oracle E-Business Suite account (PR:L) and network HTTP access to the MWA Terminal Server component of Oracle Mobile Application Server, on supported versions 12.2.3 through 12.2.15. No user interaction is needed. The limiting factor is the authentication requirement - the attacker must already hold credentials, which excludes fully unauthenticated external attackers and favors insiders or adversaries who have obtained low-level access. Exposure is further limited to deployments that actually run and network-expose the MWA Terminal Server, which is an optional mobile/barcode component rather than a default-enabled service. |
| Impact | This is a moderate-severity confidentiality flaw (CVSS 3.1 6.5) in the MWA Terminal Server component of Oracle Mobile Application Server, part of Oracle E-Business Suite, addressed in the Oracle Critical Patch Update of October 2026. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network-reachable, low-complexity exploitation by an attacker who already holds a low-privileged account, with no user interaction required and no impact to integrity or availability - the sole impact is full disclosure of data accessible to the Mobile Application Server. No EPSS score, CISA KEV listing, or POC indicator was provided in the input; accordingly there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is tempered by the PR:L requirement (a valid account is needed), which rules out opportunistic unauthenticated mass-exploitation, but Oracle EBS environments are high-value targets and the low attack complexity makes this a real patching priority for organizations running the MWA component rather than a high-CVSS-but-low-real-risk issue. Note a data conflict: the input carries an 'Authentication Bypass' tag, yet the CVSS vector specifies PR:L (authentication required), so this is not a pre-authentication bypass - verify the tag against the Oracle advisory. |
| Exploit ScenarioDerived | An attacker possessing a low-privileged Oracle E-Business Suite account sends a crafted HTTP request to the exposed MWA Terminal Server interface and leverages the flaw to read data beyond their authorization level, up to all data accessible to the Mobile Application Server. No user interaction or elevated privileges are required. No public exploit code was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Sensitive-data disclosure in the MWA Terminal Server component of Oracle Mobile Application Server (part of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged authenticated user reach data they should not be able to read, potentially including all information accessible to the component. Exploitation requires a valid EBS account plus network access to the MWA Terminal Server over HTTP, needs no user interaction, and succeeds with low attack complexity (CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) - confidentiality only, with no integrity or availability impact. The exposure is bounded by the authentication prerequisite and by whether the optional mobile/barcode component is actually deployed and exposed; no public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV), so it is primarily an insider or post-compromise credential-abuse risk addressed in the Oracle Critical Patch Update of October 2026.
RemediationAI
Apply the Oracle Critical Patch Update of October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which contains the fix for Oracle Mobile Application Server 12.2.3 through 12.2.15; note that Oracle CPU patches are cumulative for the 12.2.x line, so systems on older 12.2.x releases may need an application of the relevant EBS patch set or upgrade to a supported 12.2.x level before the CPU can be applied, and the exact patch number is not stated in the available data - confirm it in My Oracle Support against the October 2026 CPU matrix. Where patching cannot be immediate, reduce exposure by restricting HTTP access to the MWA Terminal Server endpoints at the network layer (firewall rules, reverse proxy/WAF allow-lists limited to known handheld subnets), accepting the operational cost that legitimate mobile/RF clients outside those ranges will break; if mobile/barcode functionality is unused, stop or undeploy the MWA Terminal Server service entirely, which removes the attack surface but forfeits future mobile deployment until reinstalled. Because the flaw requires only low-privileged credentials, also review and prune unnecessary EBS accounts, enforce least privilege on any account that can reach the MWA endpoints, and monitor those accounts for anomalous data-retrieval patterns; these controls are detective and do not substitute for the patch. No public exploit code or active exploitation is currently known, so prioritization can follow standard CPU cadence rather than emergency response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Mobile Application Server (MAS) is the E-Business Suite middleware layer that serves Oracle's mobile and barcode/warehouse applications, and the MWA Terminal Server is the telnet-style terminal-service component that brokers HTTP requests from mobile and RF (radio-frequency) handheld clients into EBS application logic. The flaw manifests over HTTP against that terminal-service endpoint, and the assessed CVSS vector (PR:L, network reachable, low complexity, no UI, unchanged scope, high confidentiality impact with no integrity or availability impact) is characteristic of an access-control/authorization enforcement gap: an authenticated but low-privileged session can reach data objects or terminal sessions beyond its intended privilege. No CWE was supplied by the reporter and the Oracle advisory does not disclose the root-cause detail, so the specific missing check should be treated as an authorization weakness rather than memory corruption. Practical exposure is narrower than the raw network vector suggests: MAS/MWA is an optional, non-default deployment, so only organizations that have installed and network-exposed the MWA Terminal Server carry the attack surface, and the attacker must already hold valid EBS credentials.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP vector with low complexity and no user interaction; a low-privilege account is required (PR:L); only confidentiality is affected (C:H, I:N, A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB