EUVD-2026-61687
GHSA-p78p-6jhf-856p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible with low-privilege account required; confidentiality-only impact with no integrity or availability effect, matching the data-disclosure nature of the bypass.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthorized data disclosure in Oracle Mobile Application Server's MWA Terminal Server component affects all supported E-Business Suite deployments running versions 12.2.3 through 12.2.15. Low-privileged network attackers with HTTP access can exploit an authorization bypass to gain complete read access to all data within the Mobile Application Server's scope - including sensitive warehouse, inventory, and business records. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Oracle E-Business Suite account with at minimum low-privilege access (PR:L per CVSS), reachable to the MWA Terminal Server component over HTTP on the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 Medium score sits below the critical threshold, but several factors elevate real-world priority: Oracle's own advisory language describes this as 'easily exploitable,' the attack vector requires only a valid low-privilege account over standard HTTP with no complexity or user-interaction prerequisites, and the confidentiality impact is rated High - meaning complete data exposure within the application's accessible scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patches included in Oracle's Critical Security Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mobile Application Server
View allSame weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today