CVE-2026-83463 is a vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server) affecting versions 12.2.3 through 12.2.15. The vulnerability is difficult to exploit and requires an unauthenticated attacker to have access to the physical communication segment attached to the hardware where the server executes. Successful exploitation can result in full compromise of the Oracle Mobile Application Server. The CVSS 3.1 vector is AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H with a base score of 7.5.

If exploited, this vulnerability allows an unauthenticated attacker with physical network segment access to take over the Oracle Mobile Application Server, impacting confidentiality, integrity, and availability of the server. However, exploitation is difficult due to the requirement of physical access to the communication segment.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers running affected versions (12.2.3 through 12.2.15) are strongly advised to apply the relevant patches promptly. Oracle recommends remaining on actively supported versions and applying security updates without delay to mitigate this and other vulnerabilities.