CVE-2026-83464

CVE-2026-83464 is a difficult-to-exploit, unauthenticated vulnerability in the MWA Terminal Server component of the Oracle Mobile Application Server within Oracle E-Business Suite, affecting releases 12.2.3 through 12.2.15. An attacker who can reach the service over the network via TCP — with no credentials or user interaction required — could exploit a flaw in the telnet-style terminal server to fully compromise the Mobile Application Server, impacting confidentiality, integrity, and availability (CVSS 3.1 base score 8.1). The high attack complexity (AC:H) means reliable exploitation likely requires significant skill, timing, or knowledge of the target environment rather than a simple one-click attack. Organizations running EBS 12.2 with MWA enabled for mobile warehouse/barcode data collection are the affected population, particularly if the MWA TCP ports are reachable from untrusted networks. No public proof-of-concept exists and the flaw is not on the CISA KEV, so exploitation in the wild is presumed unlikely at this time.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83464 to all EBS 12.2.3-12.2.15 instances running the Mobile Application Server. Restrict MWA Terminal Server TCP ports (default 10230-10232 range) to trusted internal subnets and mobile-device VLANs via firewall rules, and verify none are exposed to the internet with an external port scan. Review MWA service logs for anomalous connection attempts or unexpected sessions from unknown source IPs as an indicator of probing.