CVE-2026-60846: Medium severity Oracle Oracle Mobile Application Server vulnerability
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data as well as unauthorized update, insert or delete access to some of Oracle Mobile Application Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Application Server. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Mobile Application Server (MWA Terminal Server)to a version that resolves this vulnerability.Fixed in 12.2.3-12.2.15
Event History
Frequently Asked Questions
Which deployments are affected?
Affected supported versions are Oracle E-Business Suite 12.2.3 through 12.2.15 when using the Oracle Mobile Application Server MWA Terminal Server component.
What access does an attacker need?
An attacker needs network access to the affected service via HTTP and high privileges. No user interaction is required, and the attack complexity is low.
What could exploitation allow?
Successful exploitation can expose critical data or all data accessible to Oracle Mobile Application Server, allow update, insert, or delete operations on some accessible data, and cause a hang or repeatable crash resulting in denial of service.