CVE-2026-60846 in Mobile Application Server
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data as well as unauthorized update, insert or delete access to some of Oracle Mobile Application Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Application Server. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the Oracle Mobile Application Server component known as MWA Terminal Server within the broader Oracle E-Business Suite ecosystem. The affected versions span from 12.2.3 through 12.2.15, representing a substantial release range that indicates this flaw has persisted across multiple iterations of the mobile application server framework. The vulnerability architecture points to a critical security weakness that can be exploited by attackers with high privileges and network access through HTTP protocols, making it particularly concerning for organizations operating these legacy systems.
The technical nature of this vulnerability manifests as an easily exploitable flaw that allows attackers to gain unauthorized access to sensitive data within the Oracle Mobile Application Server environment. The CVSS 3.1 scoring system rates this vulnerability at 6.7, indicating a medium-high severity threat with significant impact potential across confidentiality, integrity, and availability domains. Attackers can potentially achieve complete access to all data accessible through the server while also gaining unauthorized capabilities to modify, insert, or delete information within the system. The vulnerability's impact extends beyond data compromise to include complete denial of service conditions that can cause system hangs or frequent crashes, effectively rendering the application server non-operational.
The operational implications of this vulnerability are severe and multifaceted for organizations relying on Oracle Mobile Application Server implementations. A successful exploitation could result in unauthorized access to critical business data, potentially exposing sensitive financial information, customer records, or proprietary business intelligence. The integrity impact allows attackers to modify or corrupt system data, which could lead to financial losses, regulatory compliance violations, or operational disruptions. The availability component creates additional risk through potential system crashes that could halt business operations entirely, particularly in mission-critical environments where mobile application server functionality is essential for business processes.
Organizations should prioritize immediate remediation efforts including applying the relevant Oracle Critical Patch Updates (CPU) and implementing network segmentation controls to limit access to the affected components. Access controls should be strengthened through proper authentication mechanisms and privilege management to reduce the attack surface. Monitoring systems should be enhanced to detect unusual network activity patterns targeting HTTP endpoints, particularly those associated with MWA Terminal Server functionality. This vulnerability aligns with CWE-284 (Improper Access Control) and may map to ATT&CK techniques involving credential access and privilege escalation. The combination of high privilege requirements with network accessibility creates a dangerous attack vector that organizations must address through comprehensive security hardening procedures and regular vulnerability assessment protocols.