CVE-2026-60845 in Mobile Application Server
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA General Bugs). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Application Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability resides within the Oracle Mobile Application Server component of Oracle E-Business Suite, specifically categorized under MWA General Bugs within the broader Oracle E-Business Suite framework. This security flaw affects versions 12.2.3 through 12.2.15, representing a significant attack surface for malicious actors targeting enterprise mobile infrastructure. The vulnerability operates at the application layer and demonstrates characteristics that align with CWE-284 (Improper Access Control) and CWE-310 (Cryptographic Issues) within the Common Weakness Enumeration catalog, indicating potential weaknesses in authorization mechanisms and security protocols.
The technical exploitation of this vulnerability requires an attacker with high privileges and network access through HTTP protocols to successfully compromise the Oracle Mobile Application Server environment. This attack vector demonstrates a medium to low complexity requirement for exploitation, as indicated by the CVSS 3.1 base score of 7.2, which reflects the combination of the attack vector being network-based AV:N, low attack complexity AC:L, high privileges required PR:H, and no user interaction needed UI:N. The vulnerability's impact assessment reveals severe consequences across all three core security principles with high confidentiality, integrity, and availability implications, suggesting that successful exploitation could lead to complete system compromise.
The operational impact of this vulnerability extends beyond simple data breaches or service disruption, as it provides attackers with the capability to achieve full takeover of the Oracle Mobile Application Server. This level of compromise represents a critical threat to enterprise mobile infrastructure and business continuity operations. Organizations utilizing affected versions of Oracle E-Business Suite face significant exposure risks, particularly in environments where mobile applications handle sensitive business data or support mission-critical processes.
Security mitigation strategies should prioritize immediate patching of affected systems through Oracle's official security updates and advisories. Network segmentation controls and enhanced monitoring of HTTP traffic can help detect potential exploitation attempts. The vulnerability's classification under ATT&CK framework may relate to techniques involving privilege escalation and remote code execution, making comprehensive endpoint protection and access control reviews essential. Organizations should also implement robust network access controls and consider deploying intrusion detection systems to monitor for anomalous behavior patterns consistent with exploitation of this class of vulnerability. The CVSS vector components indicate that while the attack requires elevated privileges, the potential damage justifies immediate remediation efforts across all affected Oracle Mobile Application Server deployments.