CVE-2026-70732
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Vulnerability in Oracle Mobile Application Server (component: MWA Terminal Server) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain complete access to critical data. The attack is easy to exploit.
Risk Assessment
The risk is full unauthorized access to mobile application data, potentially compromising confidentiality.
Recommendation
Apply Oracle patches for Oracle E-Business Suite and restrict network access to the mobile application server.
Other vulnerabilities in Oracle Mobile Application Server
See all- CVE-2026-83462Critical
Vulnerability in Oracle Mobile Application Server (component: MWA Terminal Server) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via TCP can easily exploit it, leading to takeover of the system. CVSS 3.1 Base Score 9.8.
- CVE-2026-83465High
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server) affecting versions 12.2.3-12.2.15. Easily exploitable by an unauthenticated attacker with network access via HTTP, requiring human interaction, leading to hang or frequently repeatable crash (complete DOS) and unauthorized update, insert, or delete access to data. CVSS 3.1 Base Score 8.2.
- CVE-2026-83464High
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server) affecting versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to take over Oracle Mobile Application Server. CVSS 3.1 Base Score 8.1.
- CVE-2026-83463High
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server) affecting versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment to take over Oracle Mobile Application Server. CVSS 3.1 Base Score 7.5.
- CVE-2026-83461High
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server) affecting versions 12.2.3-12.2.15. Easily exploitable by an unauthenticated attacker with network access via TCP, leading to unauthorized access to critical data and partial DOS. CVSS 3.1 Base Score 8.2.
- CVE-2026-60846Medium
Vulnerability in Oracle Mobile Application Server (component: MWA Terminal Server) versions 12.2.3-12.2.15. Allows a high privileged attacker with network access via HTTP to compromise the server. Successful attacks can result in unauthorized access to critical data, full access to all server data, unauthorized update/insert/delete access, and denial of service. CVSS 3.1 Base Score 6.7.
Original NVD description (English source)
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS