Oracle Mobile Application EUVD-2026-61687

Exploitation requires a valid Oracle E-Business Suite account with at minimum low-privilege access (PR:L per CVSS), reachable to the MWA Terminal Server component over HTTP on the network. The MWA Terminal Server sub-component must be deployed and network-accessible - organizations that have not deployed the Mobile Warehouse Application feature or have restricted HTTP access to the MWA endpoint are not directly exposed. No specific non-default configuration is required beyond having MWA enabled; versions 12.2.3 through 12.2.15 are all within scope. Exploitation is bounded to confidentiality only - no write access, data modification, or service disruption is achievable through this vector. The limiting factor is the authentication requirement: unauthenticated external attackers without any Oracle EBS credentials cannot directly exploit this flaw based on the PR:L CVSS rating.

The CVSS 6.5 Medium score sits below the critical threshold, but several factors elevate real-world priority: Oracle's own advisory language describes this as 'easily exploitable,' the attack vector requires only a valid low-privilege account over standard HTTP with no complexity or user-interaction prerequisites, and the confidentiality impact is rated High - meaning complete data exposure within the application's accessible scope. The 'Authentication Bypass' tag suggests that minimal credentials (e.g., a warehouse operator account) may be sufficient to access data intended for administrative or cross-tenant roles, compounding the impact beyond what a raw C:H rating conveys in isolation. No EPSS score was available to quantify exploitation probability, and the absence of a KEV listing and public exploit indicates no confirmed widespread opportunistic attacks at time of analysis - however, the low technical barrier means even a mid-sized municipal IT team in olsztyn running Oracle E-Business Suite with MWA enabled should treat this as an urgent patching priority rather than a deferred item. The missing CWE is a data gap that prevents confirming the precise bypass mechanism; root cause remains inferred from available tags and CVSS alone.

An attacker holding any valid low-privilege Oracle E-Business Suite account - such as a warehouse operator, scanner terminal user, or read-only reporting credential - sends a crafted HTTP request directly to the MWA Terminal Server endpoint. The authorization bypass allows the account to read data outside its assigned scope, potentially exposing inventory records, customer orders, financial transactions, or other business-critical data accessible to the Mobile Application Server. No public proof-of-concept code has been identified, but the low attack complexity means that any user familiar with Oracle EBS HTTP APIs could construct an exploit without specialized tooling.