This vulnerability affects the Oracle Mobile Application Server component of Oracle E-Business Suite (MWA Terminal Server) in versions 12.2.3 to 12.2.15. It is exploitable by an attacker with high privileges and network access over HTTP. Exploitation can result in unauthorized access to all accessible data, unauthorized update, insert, or delete operations on some data, and the ability to cause a denial of service by hanging or crashing the server. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H) reflects network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and high availability impact. No vendor advisory explicitly states the availability of a patch or mitigation for this vulnerability. The Oracle Critical Patch Update Advisory for July 2026 does not specifically mention this vulnerability or its patch status. Therefore, patch status is not yet confirmed and should be verified via the vendor advisory.

An attacker with high privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data or full access to all data accessible by Oracle Mobile Application Server. The attacker can also perform unauthorized data modifications (update, insert, delete) on some data and cause denial of service by hanging or crashing the server. This impacts confidentiality (high), integrity (low), and availability (high) of the affected system.

Patch status is not yet confirmed — check the Oracle Critical Patch Update Advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available. Until a patch is confirmed, restrict network access to Oracle Mobile Application Server to trusted users with high privileges and monitor for unusual activity. No vendor advisory states that no action is required or that the vulnerability is already mitigated.