CVE-2026-83462: Critical severity Oracle Oracle Mobile Application Server vulnerability
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Application Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle E-Business Suite - Oracle Mobile Application Server (MWA Terminal Server)to a version that resolves this vulnerability.Fixed in 12.2.3-12.2.15
Event History
Frequently Asked Questions
Which deployments are affected?
Oracle Mobile Application Server deployments using the MWA Terminal Server component are affected on supported Oracle E-Business Suite versions 12.2.3 through 12.2.15.
Does exploitation require authentication or user interaction?
No. The vulnerability is described as easily exploitable by an unauthenticated attacker with network access via TCP, and it requires no user interaction.
What is the potential impact of successful exploitation?
A successful attack can result in takeover of Oracle Mobile Application Server, with high impacts to confidentiality, integrity, and availability.