EUVD-2026-47145
GHSA-pg43-vf64-9v3x
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H
PR:H confirmed by description; C:H and A:H reflect complete data read and repeatable crash; I:L per description's explicit 'some' write access limitation.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data as well as unauthorized update, insert or delete access to some of Oracle Mobile Application Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Application Server. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H).
AnalysisAI
Unauthorized data access and denial of service in Oracle Mobile Application Server's MWA Terminal Server component (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a high-privileged attacker over HTTP. Successful exploitation grants complete read access to all data accessible by the Mobile Application Server, limited write capability (insert/update/delete on some data), and the ability to cause a complete, repeatable denial-of-service crash. The 'Authentication Bypass' tag in the intelligence data conflicts with the PR:H CVSS metric, suggesting the flaw may allow an authenticated administrator to bypass authorization controls beyond their intended access scope. No public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Oracle Mobile Application Server is a component of Oracle E-Business Suite that bridges mobile terminal clients with backend EBS application services, primarily using the MWA (Mobile Web Application) Terminal Server sub-component over HTTP. The affected version range is 12.2.3 through 12.2.15, a broad span of E-Business Suite deployments. No CWE identifier has been assigned by NVD or Oracle, making precise root cause classification impossible from available data. The 'Authentication Bypass' tag applied by the reporter suggests the underlying weakness may relate to improper access control (CWE-284 or CWE-863 Authorization Bypass) rather than a memory corruption or injection class flaw. The attack vector is purely network-based, requiring no special network positioning such as adjacent-network access, implying the Terminal Server component is exposed on a standard HTTP interface.
RemediationAI
Apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle has not publicly disclosed an exact patched version number beyond the CPU reference; organizations should follow Oracle's standard CPU application procedures for E-Business Suite. As a compensating control while patching, restrict HTTP network access to the MWA Terminal Server endpoint to a tightly scoped allowlist of trusted administrative IP ranges, since the attack requires network reachability. If mobile terminal functionality is not actively in use, disabling or decommissioning the MWA Terminal Server component eliminates the attack surface entirely, though this will interrupt any mobile client connectivity to E-Business Suite. Audit administrative account usage on the Mobile Application Server to detect anomalous data access patterns that may indicate exploitation attempts.
More in Mobile Application Server
View allSame weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today