Description
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Confidentiality Breach
Action: Patch
AI Analysis

Impact

The vulnerability is in Oracle Mobile Application Server (component MWA Terminal Server). An attacker with low-level privileges and network access via HTTP can compromise the server, allowing unauthorized access to critical data or complete access to all data the server can provide. The flaw results in confidentiality loss; the CVSS vector indicates high impact on confidentiality with no impact on integrity or availability.

Affected Systems

Affected versions are Oracle Mobile Application Server 12.2.3 through 12.2.15. The vendor is Oracle Corporation and the product is Oracle Mobile Application Server.

Risk and Exploitability

The CVSS base score of 6.5 indicates moderate severity. The attack requires network access via HTTP and low privilege. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog. The likelihood of exploitation is uncertain but the flaw is readily exploitable due to the direct network exposure.

Generated by OpenCVE AI on October 21, 2026 at 03:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patches for Oracle Mobile Application Server versions 12.2.3–12.2.15.
  • Limit HTTP/HTTPS access to the MWA Terminal Server by restricting inbound connections to trusted IP ranges or VPNs.
  • Enforce least privilege and role-based access controls on the server to reduce the risk of unauthorized data access.

Generated by OpenCVE AI on October 21, 2026 at 03:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Disclosure via HTTP in Oracle Mobile Application Server
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle mobile Application Server
CPEs cpe:2.3:a:oracle:mobile_application_server:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle mobile Application Server
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Mobile Application Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T17:17:58.853Z

Reserved: 2026-09-28T15:40:09.509Z

Link: CVE-2026-101828

cve-icon Vulnrichment

Updated: 2026-10-22T17:03:00.887Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:38.837

Modified: 2026-10-22T18:17:26.090

Link: CVE-2026-101828

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T19:15:15Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control