CVE-2026-83464
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server) affecting versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to take over Oracle Mobile Application Server. CVSS 3.1 Base Score 8.1.
Risk Assessment
An attacker can take over Oracle Mobile Application Server, impacting confidentiality, integrity, and availability. High risk for organizations using this module.
Recommendation
Immediately apply available Oracle security updates for versions 12.2.3-12.2.15. Restrict network access via TCP and monitor for unusual activity.
Other vulnerabilities in Oracle Mobile Application Server
See all- CVE-2026-83462Critical
Vulnerability in Oracle Mobile Application Server (component: MWA Terminal Server) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via TCP can easily exploit it, leading to takeover of the system. CVSS 3.1 Base Score 9.8.
- CVE-2026-83465High
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server) affecting versions 12.2.3-12.2.15. Easily exploitable by an unauthenticated attacker with network access via HTTP, requiring human interaction, leading to hang or frequently repeatable crash (complete DOS) and unauthorized update, insert, or delete access to data. CVSS 3.1 Base Score 8.2.
- CVE-2026-83463High
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server) affecting versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment to take over Oracle Mobile Application Server. CVSS 3.1 Base Score 7.5.
- CVE-2026-83461High
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server) affecting versions 12.2.3-12.2.15. Easily exploitable by an unauthenticated attacker with network access via TCP, leading to unauthorized access to critical data and partial DOS. CVSS 3.1 Base Score 8.2.
- CVE-2026-70732Medium
Vulnerability in Oracle Mobile Application Server (component: MWA Terminal Server) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain complete access to critical data. The attack is easy to exploit.
- CVE-2026-60846Medium
Vulnerability in Oracle Mobile Application Server (component: MWA Terminal Server) versions 12.2.3-12.2.15. Allows a high privileged attacker with network access via HTTP to compromise the server. Successful attacks can result in unauthorized access to critical data, full access to all server data, unauthorized update/insert/delete access, and denial of service. CVSS 3.1 Base Score 6.7.
Original NVD description (English source)
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Application Server. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS