What is the CVSS score of CVE-2026-83462?

CVE-2026-83462 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-83462?

Within 24 hours, inventory every Oracle E-Business Suite 12.2.3 through 12.2.15 instance and determine whether the Oracle Mobile Application Server (MWA Terminal Server) TCP listener is enabled and reachable from any untrusted network; immediately block that listener at the network edge and host firewall, allowing only trusted warehouse/handheld-terminal subnets, and if the service is not operationally required, stop or disable it. Within 7 days, validate the exposure with internal and external scans, review firewall and segmentation rules for the MWA Terminal Server port, place all reachable instances behind VPN or zero-trust access, enable detailed logging and alerting for connections to the listener, and open a priority case with Oracle support to obtain patch timing and mitigation guidance. Within 30 days, apply Oracle's vendor-released patch as soon as it is available for E-Business Suite 12.2.3 through 12.2.15, or otherwise decommission, upgrade, or permanently isolate the MWA Terminal Server; complete a long-term architecture review to confirm that warehouse/handheld services are not exposed to untrusted networks, and add this component to continuous vulnerability and configuration monitoring.

Oracle E-Business Suite CVE-2026-83462

EUVD-2026-79761 CRITICAL

Improper Authentication (CWE-287)

2026-09-15 secalert_us@oracle.com

GHSA-jxhp-5jq7-4mmc

Authentication Bypass Oracle Mobile Application Server

9.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach MWA Terminal Server TCP port
Delivery

Send crafted authentication-bypass request
Exploit

Bypass authentication (CWE-287)
Execution

Gain server control
Impact

Full takeover of Mobile Application Server

Vulnerability Assessment

Weakness	CWE CWE-287 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Authentication mechanism validation MITRE ATT&CK 2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires network reachability to the Oracle Mobile Application Server's MWA Terminal Server component listening over TCP (the telnet-style mobile/RF terminal service used by E-Business Suite handheld applications), on supported versions 12.2.3 through 12.2.15. No authentication, privileges, or user interaction are needed (AV:N/AC:L/PR:N/UI:N), so any attacker able to reach that TCP port against a default deployment can attempt takeover. The primary limiting factor is exposure: MWA Terminal Server is typically an internal warehouse/inventory-facing service, so risk is far higher where that TCP port is reachable from untrusted networks than where it is segmented behind the enterprise perimeter.
Impact	This is a genuine high-priority vulnerability, not a high-CVSS/low-real-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is internally consistent with the description: unauthenticated network attacker over TCP achieving full product takeover, mapped to CWE-287 (Improper Authentication). All three impact metrics are High and the description explicitly says 'takeover,' so the score is well-calibrated with no CVSS-vs-description conflict. CISA's SSVC framework reinforces this: Technical Impact 'total' and Automatable 'yes' align with a low-complexity pre-auth flaw that could be scripted at scale. The one moderating signal is SSVC Exploitation 'none' - combined with the absence of any EPSS score, KEV listing, or public POC, this means there is currently no evidence of exploitation or weaponization, so real-world risk today is driven by exposure and automatability rather than observed attacks. EPSS, KEV, and POC data are all absent from the input (not low - genuinely missing), so probabilistic exploitation likelihood cannot be quantified. Given Oracle's practice of withholding technical detail in Critical Patch Updates, defenders should treat this as patch-now-if-exposed based on the pre-auth full-takeover profile, while noting no exploitation is confirmed yet.
Exploit ScenarioDerived	An unauthenticated attacker who can reach the Oracle Mobile Application Server's MWA Terminal Server TCP listener sends a crafted request that bypasses authentication (CWE-287), gaining full control over the server and the mobile/RF terminal workflows it drives within Oracle E-Business Suite. Because no privileges or user interaction are required and the attack is network-based over TCP with low complexity, it is trivially repeatable and, per CISA SSVC, automatable. No public exploit code has been identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 16, 2026

Unauthenticated remote takeover of the Oracle Mobile Application Server component (MWA Terminal Server) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by any attacker who can reach the service over TCP; the flaw is rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials or user interaction are required and confidentiality, integrity, and availability are all fully impacted. CISA's SSVC assessment rates the issue as automatable with total technical impact while indicating no observed exploitation, and no public exploit code or proof of concept has been identified at time of analysis, so the practical risk is dominated by network exposure of what is normally an internal warehouse/handheld-terminal service rather than by active attack campaigns. Prioritize hosts where the MWA Terminal Server TCP listener is reachable from untrusted networks.

RemediationAI

Apply the Oracle Critical Patch Update for E-Business Suite 12.2.x referenced in the vendor advisory https://www.oracle.com/security-alerts/cspusep2026.html; the provided data identifies the advisory as the authoritative fix source and does not state a discrete patched build number, so confirm the minimum patched release for your 12.2.x level directly with Oracle before closing the item (patch available per vendor advisory). Because the flaw is an authentication bypass on the MWA Terminal Server TCP listener, the highest-value compensating control is exposure reduction: firewall or security-group the MWA Terminal Server port so only trusted warehouse/RF device subnets can reach it, or place those devices behind a segmented VLAN/VDI jump path - the trade-off is that legitimate handheld terminals on other networks will lose connectivity until rules are updated. Where MWA/handheld terminal access is not in use, stop the MWA Terminal Server service or disable the component entirely, which removes the attack surface outright at the cost of disabling RF/warehouse scanning workflows; do this only after confirming no active device population depends on it. Additional hardening includes monitoring the listener for anomalous or unexpected source IPs and repeated session attempts (the bypass is automatable per the CISA SSVC assessment, so brute-force-like scanning of the port is a realistic detection signal), and verifying that the service is not inadvertently published through reverse proxies, VPN split-tunnels, or cloud load balancers during any interim window before patching. Note that no public exploit code or proof of concept has been identified at time of analysis and CISA SSVC records exploitation as none, so patching can follow normal quarterly maintenance as long as the network-exposure mitigations above are in place for internet- or partner-reachable instances.

Affected VersionsENISA

Oracle Mobile Application Server 12.2.3 ≤12.2.15

Affected Packages

euvd oracle_mobile_application_server no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected technology is the MWA (Mobile Web Applications) Terminal Server shipped as part of Oracle Mobile Application Server within Oracle E-Business Suite. It is a telnet-style terminal service used by RF barcode scanners and other handheld devices running EBS mobile/warehouse applications, and it sits in front of the E-Business Suite application stack, brokering terminal sessions between devices and the ERP backend. The root cause class is CWE-287 (Improper Authentication): the component fails to correctly establish or enforce authentication for inbound sessions, so an attacker with network access can bypass the expected credential check and obtain control of the service and, transitively, the sessions it brokers. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the bypass is reachable remotely with low complexity and with no privileges (PR:N) and no user interaction (UI:N), and EUVD records the affected version range as Oracle Mobile Application Server 12.2.3 <= 12.2.15, matching the vendor's supported EBS 12.2.x line. Oracle publishes fixes for this product family through its Critical Patch Update cycle referenced at https://www.oracle.com/security-alerts/cspusep2026.html.

Know when Mobile Application Server gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD HIGH

vuln.today AI 9.8 CRITICAL

Description confirms unauthenticated (PR:N) low-complexity network TCP access (AV:N/AC:L) yielding full product takeover, so C/I/A all High and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Application Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle E-Business Suite 12.2.3 through 12.2.15 deployments that expose the Mobile Application Server (MWA Terminal Server) carry a critical unauthenticated remote-takeover risk that could let an attacker fully compromise the service and connected business data. Organizations using this component for warehouse, handheld-terminal, or mobile supply-chain workflows are most affected, especially if the listener is reachable beyond trusted internal networks, although there is no public exploit identified at time of analysis. Leadership should treat this as a high-priority exposure because no vendor-released patch is currently available and successful exploitation would affect confidentiality, integrity, and availability at the application layer.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Until a patch is available, restrict access to the Oracle E-Business Suite MWA Terminal Server to trusted warehouse/handheld-terminal networks, block the TCP listener from untrusted networks, disable the service where not required, enforce VPN/zero-trust access, enable logging and intrusion detection for the listener, and monitor for anomalous connections or service behavior.

Threat Intelligence Overview

EPSS Score

0.5%

Top 60% exploitable

Prevalence

Medium

E-Business Suite is widely deployed ERP, but MWA Terminal Server is a niche RF/handheld component

Threat Intel

1 source

Data Quality

7 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment NCSC-NL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.