CVE-2026-70732

MediumCVSS 6.5

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

Vulnerability in Oracle Mobile Application Server (component: MWA Terminal Server) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain complete access to critical data. The attack is easy to exploit.

Risk Assessment

The risk is full unauthorized access to mobile application data, potentially compromising confidentiality.

Recommendation

Apply Oracle patches for Oracle E-Business Suite and restrict network access to the mobile application server.

Original NVD description (English source)

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).