CVE-2026-83464

Received Received - Intake

Oracle Mobile Application Server Remote Code Execution

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Oracle

Description

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Application Server. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83464

EUVD

EUVD-2026-79763

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	mobile_application_server	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Mobile Application Server, part of Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. The issue allows an unauthenticated attacker with network access to potentially take over the server by exploiting a TCP connection.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of Oracle Mobile Application Server (12.2.3-12.2.15) running on your network. Use network scanning tools like Nmap to identify open TCP ports associated with the MWA Terminal Server component. Example command: nmap -p 8000-9000 --script oracle-mwa-info <target_IP>. Review server logs for unusual activity or unauthorized access attempts.

Impact Analysis

If exploited, this vulnerability could lead to complete compromise of the Oracle Mobile Application Server. This means an attacker could gain full control over the server, potentially accessing, modifying, or deleting sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access or loss of data integrity and availability, which are key concerns under GDPR and HIPAA. A successful attack may result in non-compliance due to potential data breaches or system disruptions.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite to patch the Oracle Mobile Application Server. If immediate patching is not possible, restrict network access to the MWA Terminal Server via firewalls or disable the service if unused. Monitor Oracle security advisories for updates and isolate affected systems until patched.

Hi! I’m here to help you understand CVE-2026-83464. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70