Description

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T21:17:25.853Z",
  "pubdate": "2026-08-18T21:17:25.853Z",
  "executiveSummary": "A vulnerability affects the Oracle Mobile Application Server component of Oracle E-Business Suite, specifically within the MWA Terminal Server sub-component across supported versions 12.2.3 through 12.2.15.\nThe security flaw allows a low-privileged remote attacker with network access via HTTP to bypass security controls and compromise the Oracle Mobile Application Server.\nSuccessful exploitation of this vulnerability results in unauthorized access to critical data or complete access to all data accessible by the Oracle Mobile Application Server.\nThe vulnerability is classified with a CVSS 3.1 Base Score of 6.5, driven entirely by high confidentiality impacts, while integrity and availability remain unaffected.\nThe attack vector is network-based (AV:N), exploitation complexity is low (AC:L), user interaction is not required (UI:N), the scope is unchanged (S:U), and the required privileges are low (PR:L).\nRisk implications include potential exfiltration of sensitive organizational data managed within the mobile supply chain and warehouse applications environment, necessitating immediate patching or application of vendor-supplied mitigations.",
  "technicalDetails": "The vulnerability resides within the MWA Terminal Server component of the Oracle Mobile Application Server, part of the broader Oracle E-Business Suite architecture.\nThe affected software versions include 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10, 12.2.11, 12.2.12, 12.2.13, 12.2.14, and 12.2.15.\nThe root cause stems from insufficient authorization checks or inadequate access control enforcement within the HTTP request handling mechanism of the MWA Terminal Server.\nAn attacker must possess low-privileged credentials within the Oracle E-Business Suite environment to authenticate to the application.\nExploitation is initiated via network access over the HTTP protocol, targeting exposed service endpoints on the Oracle Mobile Application Server.\nThe attack flow proceeds as follows: First, the low-privileged attacker establishes an HTTP connection to the vulnerable MWA Terminal Server endpoint. Second, the attacker crafts specialized requests designed to query or retrieve resources outside their authorized scope. Third, due to the absence of robust access validation logic, the MWA Terminal Server processes the request and returns the requested confidential information. Finally, the attacker captures the response payload, gaining unauthorized access to critical operational data or complete datasets accessible to the server context.\nThe post-exploitation impact is strictly confined to the confidentiality vector, enabling the retrieval of sensitive data stored or processed by the mobile application server without altering system integrity or causing denial of service."
}