A network‑based vulnerability in Oracle Mobile Application Server allows an unauthenticated attacker to create, delete or modify critical data, granting full access to all data the server hosts. The flaw is a testament to the server’s weakness in properly authenticating requests and enforcing access control, allowing an attacker to bypass normal security checks. Users of versions 12.2.3 through 12.2.15 who expose the MWA Terminal Server over HTTP are most at risk, as the vulnerability directly impacts confidentiality and integrity of stored information.

The vulnerability affects Oracle Corporation’s Oracle Mobile Application Server component of Oracle E‑Business Suite, specifically the MWA Terminal Server, for supported versions from 12.2.3 through 12.2.15. Managers of these installations should review their environment to confirm the product version and whether the service is reachable via the public network.

The CVSS score of 7.4 indicates high severity, with significant confidentiality and integrity impacts; the absence of an exploit probability in EPSS suggests current known exploitation activity is limited or unknown. The attack vector is inferred to be an HTTP connection, as the description specifies network access via HTTP and the attacker can remain unauthenticated. The flaw falls under the category of improper access control and authentication, making it highly actionable for attackers that can simply send crafted HTTP requests to gain compromise. While the flaw is not listed in the CISA KEV catalog, the high severity and the ease of exploitation recommend immediate attention and remediation.