This vulnerability affects Oracle Mobile Application Server, a component of Oracle E-Business Suite (MWA Terminal Server), in versions 12.2.3 through 12.2.15. An attacker with network access via TCP can exploit this flaw without authentication to gain full control over the server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can result in complete compromise of confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes patches that address this vulnerability among 673 others across multiple products. Oracle strongly recommends applying these patches promptly to mitigate exploitation risks.

Successful exploitation allows an unauthenticated remote attacker to take over the Oracle Mobile Application Server, compromising confidentiality, integrity, and availability of the affected system. This can lead to full control over the server and potentially the broader environment it supports.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Mobile Application Server versions 12.2.3 through 12.2.15 without delay. Oracle emphasizes remaining on actively supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.