CVE-2026-83465
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server) affecting versions 12.2.3-12.2.15. Easily exploitable by an unauthenticated attacker with network access via HTTP, requiring human interaction, leading to hang or frequently repeatable crash (complete DOS) and unauthorized update, insert, or delete access to data. CVSS 3.1 Base Score 8.2.
Risk Assessment
An attacker can cause complete DOS and modify data, impacting integrity and availability. This may significantly impact additional products (scope change).
Recommendation
Immediately apply available Oracle security updates for versions 12.2.3-12.2.15. Restrict network access and educate users about interacting with suspicious content.
Other vulnerabilities in Oracle Mobile Application Server
See all- CVE-2026-83462Critical
Vulnerability in Oracle Mobile Application Server (component: MWA Terminal Server) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via TCP can easily exploit it, leading to takeover of the system. CVSS 3.1 Base Score 9.8.
- CVE-2026-83464High
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server) affecting versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to take over Oracle Mobile Application Server. CVSS 3.1 Base Score 8.1.
- CVE-2026-83463High
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server) affecting versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment to take over Oracle Mobile Application Server. CVSS 3.1 Base Score 7.5.
- CVE-2026-83461High
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server) affecting versions 12.2.3-12.2.15. Easily exploitable by an unauthenticated attacker with network access via TCP, leading to unauthorized access to critical data and partial DOS. CVSS 3.1 Base Score 8.2.
- CVE-2026-70732Medium
Vulnerability in Oracle Mobile Application Server (component: MWA Terminal Server) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain complete access to critical data. The attack is easy to exploit.
- CVE-2026-60846Medium
Vulnerability in Oracle Mobile Application Server (component: MWA Terminal Server) versions 12.2.3-12.2.15. Allows a high privileged attacker with network access via HTTP to compromise the server. Successful attacks can result in unauthorized access to critical data, full access to all server data, unauthorized update/insert/delete access, and denial of service. CVSS 3.1 Base Score 6.7.
Original NVD description (English source)
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Mobile Application Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Application Server as well as unauthorized update, insert or delete access to some of Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS