Oracle Mobile Application Server CVE-2026-60846

Exploitation requires the attacker to hold high-privileged (administrative-level) credentials on Oracle Mobile Application Server and have network access to the system via HTTP. The vulnerability is specific to the MWA Terminal Server component, meaning the Oracle E-Business Suite deployment must have Mobile Application Server with this component active and network-reachable. The attack is limited to E-Business Suite versions 12.2.3 through 12.2.15; versions outside this range are not confirmed affected. The 'Authentication Bypass' tag raises an unresolved question: if the flaw allows authentication or authorization bypass, the effective privilege prerequisite may be lower than PR:H. Until Oracle clarifies this discrepancy, assume high-privileged authentication is required, which limits exploitation to insider threats and accounts compromised via separate attack paths.

The CVSS 3.1 score of 6.7 reflects a meaningful but not critical severity, primarily constrained by the high privilege requirement (PR:H). The attack vector being network-accessible (AV:N) and low complexity (AC:L) means an attacker who already holds administrative credentials faces no technical barriers to exploitation. The combined impact of high confidentiality and high availability loss elevates real-world concern for organizations where this component is actively used. However, the PR:H requirement substantially narrows the threat actor population to insiders, compromised admin accounts, or attackers who have already achieved privileged access through a prior step. EPSS data is not available in the provided intelligence, precluding probabilistic exploitation likelihood assessment. No KEV listing and no public proof-of-concept code have been identified, indicating no confirmed widespread exploitation. The 'Authentication Bypass' tag introduces an unresolved conflict with the PR:H metric - if this tag is accurate, the effective attack complexity or privilege requirement may be lower than the CVSS vector indicates, which would materially increase real-world risk. Security teams should treat this discrepancy as a flag requiring vendor clarification before downgrading remediation priority.

An attacker with high-privileged (administrative) access to Oracle Mobile Application Server authenticates and sends a crafted HTTP request to the MWA Terminal Server endpoint, exploiting an apparent authorization bypass to read data beyond their intended access scope - potentially extracting the entirety of data accessible to the Mobile Application Server. The same or a follow-up request triggers a hang or repeatable crash condition, causing a complete denial-of-service for mobile terminal users. No public exploit code exists at time of analysis, so exploitation currently requires attacker-developed tooling.