Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). (CVE-2026-83461)
A vulnerability exists in the Oracle Mobile Application Server component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. This flaw allows an unauthenticated attacker with network access via TCP to gain unauthorized access to critical data or cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with significant confidentiality and availability impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.
AI Analysis
Technical Summary
CVE-2026-83461 is a vulnerability in the Oracle Mobile Application Server product within Oracle E-Business Suite (component: MWA Terminal Server) affecting supported versions 12.2.3 through 12.2.15. The flaw permits an unauthenticated attacker with network access via TCP to compromise the server, resulting in unauthorized access to critical data and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, with a base score of 8.2. Oracle has released security patches as part of its September 2026 Critical Security Patch Update to remediate this issue.
Potential Impact
Successful exploitation can lead to unauthorized access to all data accessible by Oracle Mobile Application Server and partial denial of service conditions. The vulnerability impacts confidentiality and availability but does not affect integrity. The high CVSS score reflects the ease of exploitation and the critical nature of the data exposure.
Mitigation Recommendations
Oracle has provided an official fix for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). (CVE-2026-83461)
Description
A vulnerability exists in the Oracle Mobile Application Server component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. This flaw allows an unauthenticated attacker with network access via TCP to gain unauthorized access to critical data or cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with significant confidentiality and availability impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.
CVSS v3.1
Score 8.2high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-83461 is a vulnerability in the Oracle Mobile Application Server product within Oracle E-Business Suite (component: MWA Terminal Server) affecting supported versions 12.2.3 through 12.2.15. The flaw permits an unauthenticated attacker with network access via TCP to compromise the server, resulting in unauthorized access to critical data and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, with a base score of 8.2. Oracle has released security patches as part of its September 2026 Critical Security Patch Update to remediate this issue.
Potential Impact
Successful exploitation can lead to unauthorized access to all data accessible by Oracle Mobile Application Server and partial denial of service conditions. The vulnerability impacts confidentiality and availability but does not affect integrity. The high CVSS score reflects the ease of exploitation and the critical nature of the data exposure.
Mitigation Recommendations
Oracle has provided an official fix for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-hm54-gfqc-2v44
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-83461"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aaa07db55bf5e2cf5ea3256
Added to database: 09/16/2026, 03:07:07 UTC
Last enriched: 09/16/2026, 03:46:36 UTC
Last updated: 09/16/2026, 04:01:23 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.