---
id: "CVE-2026-101828"
kind: "vulnerability"
aliases: ["CVE-2026-101828"]
title: "Oracle E-Business Suite: Mobile Application Server flaw exposes data to low-privileged users"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["e-business-suite", "mobile-application-server", "oracle", "self-hosted", "vendor"]
not_affected_if: ["not-deployed"]
published_at: "2026-10-20T22:18:38+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:53:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101828", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Oracle E-Business Suite: Mobile Application Server flaw exposes data to low-privileged users

Oracle's Mobile Application Server, part of E-Business Suite, has a flaw in its MWA Terminal Server component reachable over HTTP. An attacker with a low-privileged account on the network can read critical data the server can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the Oracle Mobile Application Server (MWA Terminal Server) is deployed in your E-Business Suite environment
- Check the installed E-Business Suite and Mobile Application Server patch level against Oracle's advisory: unknown

## Fix

- Apply the Oracle Critical Patch Update fix for E-Business Suite Mobile Application Server: unknown version in sources
- Restrict HTTP access to the MWA Terminal Server until patched

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101828

## From the sources

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_