Mobile Application Server
Monthly
Unauthenticated denial of service combined with unauthorized data modification in the Oracle Mobile Application Server (MWA Terminal Server) component of Oracle E-Business Suite 12.2.3 through 12.2.15. A remote attacker with HTTP access can send crafted requests that hang or repeatedly crash the MWA service while also inserting, updating, or deleting some MWA-accessible data, but the attack requires a victim — not the attacker — to perform some interaction (UI:R), and Oracle's scope-change rating indicates effects can spill over to related products. Oracle rates this 8.2 High; no public exploit code and no CISA KEV listing were identified in the supplied intelligence, and no EPSS score was provided.
Unauthenticated attackers with network reach to the Mobile Application Server of Oracle E-Business Suite can fully take over the MWA Terminal Server component in supported 12.2.3 through 12.2.15 releases, gaining high impact across confidentiality, integrity and availability. Exploitation is rated high-complexity (AC:H) but requires no credentials and no user interaction, and Oracle scores it 8.1. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so the current real-world exploitation picture is unconfirmed.
Oracle E-Business Suite's Mobile Application Server (MWA Terminal Server component) in versions 12.2.3 through 12.2.15 can be fully taken over by an unauthenticated attacker who can reach the host over an adjacent network segment. The flaw is rated 7.5 with a CVSS vector of AV:A/AC:H/PR:N/UI:N and high confidentiality, integrity and availability impact, meaning an attacker positioned on the same physical communication segment as the Mobile Application Server hardware can compromise the service without credentials, though exploitation is complicated by conditions beyond the attacker's control (AC:H). Oracle has published the fix through its Critical Security Patch Update advisory; at the time of analysis there is no CISA KEV listing, no confirmed public exploit code and no EPSS score provided.
Unauthenticated remote takeover of the Oracle Mobile Application Server component (MWA Terminal Server) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by any attacker who can reach the service over TCP; the flaw is rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials or user interaction are required and confidentiality, integrity, and availability are all fully impacted. CISA's SSVC assessment rates the issue as automatable with total technical impact while indicating no observed exploitation, and no public exploit code or proof of concept has been identified at time of analysis, so the practical risk is dominated by network exposure of what is normally an internal warehouse/handheld-terminal service rather than by active attack campaigns. Prioritize hosts where the MWA Terminal Server TCP listener is reachable from untrusted networks.
Unauthenticated TCP network access to the Oracle Mobile Application Server component (MWA Terminal Server) in Oracle E-Business Suite 12.2.3 through 12.2.15 lets an attacker bypass authentication details and gain unrestricted read access to data reachable by that service while also degrading its availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:L, base 8.2) confirms no credentials or victim interaction are needed, making exploitation trivially automatable once the middle-tier service is reachable. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Unauthorized data disclosure in Oracle Mobile Application Server's MWA Terminal Server component affects all supported E-Business Suite deployments running versions 12.2.3 through 12.2.15. Low-privileged network attackers with HTTP access can exploit an authorization bypass to gain complete read access to all data within the Mobile Application Server's scope - including sensitive warehouse, inventory, and business records. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog, but Oracle's advisory language explicitly flags it as 'easily exploitable,' reducing the practical barrier significantly.
Unauthorized data access and denial of service in Oracle Mobile Application Server's MWA Terminal Server component (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a high-privileged attacker over HTTP. Successful exploitation grants complete read access to all data accessible by the Mobile Application Server, limited write capability (insert/update/delete on some data), and the ability to cause a complete, repeatable denial-of-service crash. The 'Authentication Bypass' tag in the intelligence data conflicts with the PR:H CVSS metric, suggesting the flaw may allow an authenticated administrator to bypass authorization controls beyond their intended access scope. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated denial of service combined with unauthorized data modification in the Oracle Mobile Application Server (MWA Terminal Server) component of Oracle E-Business Suite 12.2.3 through 12.2.15. A remote attacker with HTTP access can send crafted requests that hang or repeatedly crash the MWA service while also inserting, updating, or deleting some MWA-accessible data, but the attack requires a victim — not the attacker — to perform some interaction (UI:R), and Oracle's scope-change rating indicates effects can spill over to related products. Oracle rates this 8.2 High; no public exploit code and no CISA KEV listing were identified in the supplied intelligence, and no EPSS score was provided.
Unauthenticated attackers with network reach to the Mobile Application Server of Oracle E-Business Suite can fully take over the MWA Terminal Server component in supported 12.2.3 through 12.2.15 releases, gaining high impact across confidentiality, integrity and availability. Exploitation is rated high-complexity (AC:H) but requires no credentials and no user interaction, and Oracle scores it 8.1. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so the current real-world exploitation picture is unconfirmed.
Oracle E-Business Suite's Mobile Application Server (MWA Terminal Server component) in versions 12.2.3 through 12.2.15 can be fully taken over by an unauthenticated attacker who can reach the host over an adjacent network segment. The flaw is rated 7.5 with a CVSS vector of AV:A/AC:H/PR:N/UI:N and high confidentiality, integrity and availability impact, meaning an attacker positioned on the same physical communication segment as the Mobile Application Server hardware can compromise the service without credentials, though exploitation is complicated by conditions beyond the attacker's control (AC:H). Oracle has published the fix through its Critical Security Patch Update advisory; at the time of analysis there is no CISA KEV listing, no confirmed public exploit code and no EPSS score provided.
Unauthenticated remote takeover of the Oracle Mobile Application Server component (MWA Terminal Server) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by any attacker who can reach the service over TCP; the flaw is rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials or user interaction are required and confidentiality, integrity, and availability are all fully impacted. CISA's SSVC assessment rates the issue as automatable with total technical impact while indicating no observed exploitation, and no public exploit code or proof of concept has been identified at time of analysis, so the practical risk is dominated by network exposure of what is normally an internal warehouse/handheld-terminal service rather than by active attack campaigns. Prioritize hosts where the MWA Terminal Server TCP listener is reachable from untrusted networks.
Unauthenticated TCP network access to the Oracle Mobile Application Server component (MWA Terminal Server) in Oracle E-Business Suite 12.2.3 through 12.2.15 lets an attacker bypass authentication details and gain unrestricted read access to data reachable by that service while also degrading its availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:L, base 8.2) confirms no credentials or victim interaction are needed, making exploitation trivially automatable once the middle-tier service is reachable. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Unauthorized data disclosure in Oracle Mobile Application Server's MWA Terminal Server component affects all supported E-Business Suite deployments running versions 12.2.3 through 12.2.15. Low-privileged network attackers with HTTP access can exploit an authorization bypass to gain complete read access to all data within the Mobile Application Server's scope - including sensitive warehouse, inventory, and business records. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog, but Oracle's advisory language explicitly flags it as 'easily exploitable,' reducing the practical barrier significantly.
Unauthorized data access and denial of service in Oracle Mobile Application Server's MWA Terminal Server component (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a high-privileged attacker over HTTP. Successful exploitation grants complete read access to all data accessible by the Mobile Application Server, limited write capability (insert/update/delete on some data), and the ability to cause a complete, repeatable denial-of-service crash. The 'Authentication Bypass' tag in the intelligence data conflicts with the PR:H CVSS metric, suggesting the flaw may allow an authenticated administrator to bypass authorization controls beyond their intended access scope. No public exploit or CISA KEV listing has been identified at time of analysis.