{"id":"CVE-2026-101828","kind":"vulnerability","aliases":["CVE-2026-101828"],"related":[],"title":"Oracle E-Business Suite: Mobile Application Server flaw exposes data to low-privileged users","description":"Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle's Mobile Application Server, part of E-Business Suite, has a flaw in its MWA Terminal Server component reachable over HTTP. An attacker with a low-privileged account on the network can read critical data the server can access.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-business-suite","mobile-application-server","oracle","self-hosted","vendor"],"not_affected_if":["not-deployed"],"how_to_check":"- Confirm whether the Oracle Mobile Application Server (MWA Terminal Server) is deployed in your E-Business Suite environment\n- Check the installed E-Business Suite and Mobile Application Server patch level against Oracle's advisory: unknown","fix":"- Apply the Oracle Critical Patch Update fix for E-Business Suite Mobile Application Server: unknown version in sources\n- Restrict HTTP access to the MWA Terminal Server until patched","status":"open","published_at":"2026-10-20T22:18:38+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:53:35+00:00","updated_at":"2026-10-25T03:53:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:53:35Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for E-Business Suite Mobile Application Server: unknown version in sources\n- Restrict HTTP access to the MWA Terminal Server until patched","reach":"network","title":"Oracle E-Business Suite: Mobile Application Server flaw exposes data to low-privileged users","impact":"medium","summary":"Oracle's Mobile Application Server, part of E-Business Suite, has a flaw in its MWA Terminal Server component reachable over HTTP. An attacker with a low-privileged account on the network can read critical data the server can access.","category":"vendor","nicknames":[],"who_cares":["oracle","e-business-suite","mobile-application-server","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privileged network user reads critical data from the server","analyst_note":"Find Oracle's Critical Patch Update advisory for the exact patched release and whether MWA Terminal Server is enabled by default, at https://nvd.nist.gov/vuln/detail/CVE-2026-101828.","how_to_check":"- Confirm whether the Oracle Mobile Application Server (MWA Terminal Server) is deployed in your E-Business Suite environment\n- Check the installed E-Business Suite and Mobile Application Server patch level against Oracle's advisory: unknown","needs_analyst":true,"not_affected_if":["not-deployed"],"who_is_affected":"Organisations running Oracle E-Business Suite with the Mobile Application Server and MWA Terminal Server component in supported versions 12.2.3 through 12.2.15. The sources do not say whether a default install exposes the component to the network, so teams without Mobile Application Server deployed can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":3475,"output_tokens":644,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101828':19A,22A '-2026':18A,21A '/av':157C '12.2.15':103C '12.2.3':102C '3.1':147C,156C '6.5':150C 'access':77B,113C,131C,137C,144C 'account':66B 'affect':100C 'allow':107C 'applic':7A,29B,39B,83C,120C,142C 'attack':60B,110C,123C 'base':148C 'busi':4A,25B,45B,90C 'complet':136C 'compon':55B,92C 'compromis':117C 'confidenti':151C 'critic':72B,133C 'cve':17A,20A 'cvss':146C,153C,155C 'data':11A,73B,134C,145C 'e':3A,24B,44B,89C 'e-busi':2A,43B,88C 'e-business-suit':23B 'easili':104C 'exploit':105C 'expos':10A 'flaw':9A,49B 'h/i':163C 'host':34B 'http':58B,115C 'impact':152C 'l/pr':159C 'l/ui':160C 'low':14A,64B,108C 'low-privileg':13A,63B 'mobil':6A,28B,38B,82C,119C,141C 'mobile-application-serv':27B 'mwa':52B,93C 'n':165C 'n/a':164C 'n/ac':158C 'n/s':161C 'network':69B,112C 'oracl':1A,31B,36B,81C,87C,118C,140C 'part':41B 'privileg':15A,65B,109C 'product':85C 'reachabl':56B 'read':71B 'result':128C 'score':149C 'self':33B 'self-host':32B 'server':8A,30B,40B,54B,75B,84C,95C,121C,143C 'success':122C 'suit':5A,26B,46B,91C 'support':96C 'termin':53B,94C 'u/c':162C 'unauthor':130C 'user':16A 'vector':154C 'vendor':35B 'version':97C 'via':114C 'vulner':78C,106C,126C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle E-Business Suite with the Mobile Application Server and MWA Terminal Server component in supported versions 12.2.3 through 12.2.15. The sources do not say whether a default install exposes the component to the network, so teams without Mobile Application Server deployed can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101828","severity":null,"published_at":"2026-10-20T22:18:38+00:00","modified_at":"2026-10-22T18:17:26+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}