CVE-2026-60846: Oracle Mobile App Server Escalation Flaw

CVE-2026-60846 Overview

CVE-2026-60846 affects the Oracle Mobile Application Server component of Oracle E-Business Suite, specifically the MWA Terminal Server. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a high-privileged attacker with network access via HTTP to compromise the Oracle Mobile Application Server. Successful exploitation can lead to unauthorized access to critical data, partial modification of accessible data, and a complete denial-of-service condition through a hang or repeatable crash. Oracle disclosed the issue in the July 2026 Critical Patch Update advisory.

Critical Impact
Authenticated network attackers can read all data accessible to Oracle Mobile Application Server, perform limited data modification, and trigger a complete denial-of-service of the MWA Terminal Server component.

Affected Products

Oracle E-Business Suite — Oracle Mobile Application Server 12.2.3
Oracle E-Business Suite — Oracle Mobile Application Server versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Mobile Application Server 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-60846 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60846

Vulnerability Analysis

The vulnerability resides in the MWA Terminal Server component of Oracle Mobile Application Server, part of the Oracle E-Business Suite stack. The MWA Terminal Server handles mobile client sessions that interact with warehouse and shop-floor applications over HTTP. An authenticated attacker with high privileges can send crafted HTTP requests to the server and abuse the exposed functionality to reach data and operations that should remain isolated.

Exploitation produces three distinct impacts. The attacker obtains full read access to all data reachable by the Mobile Application Server. The attacker also gains limited write, insert, or delete capability over a subset of that data. The attacker can force the MWA Terminal Server into a hang or repeatable crash, producing a complete outage of the mobile application tier.

Oracle classifies the issue as easily exploitable but requires elevated privileges within the E-Business Suite environment. No user interaction is needed, and the attack scope remains unchanged. Public exploit code and evidence of in-the-wild exploitation are not currently available. The EPSS probability is 0.396%.

Root Cause

Oracle has not published the specific root cause in the July 2026 Critical Patch Update summary. The impact profile — combined confidentiality, limited integrity, and full availability loss — is consistent with insufficient validation of authenticated HTTP requests processed by the MWA Terminal Server listener.

Attack Vector

The attack traverses the network and reaches the MWA Terminal Server over HTTP. The attacker must already hold a high-privileged account inside the Oracle E-Business Suite deployment. Once authenticated, the attacker issues malformed or unauthorized requests that trigger the data disclosure, modification, and crash behavior described in the advisory.

Refer to the Oracle Security Alert July 2026 for the authoritative technical description.

Detection Methods for CVE-2026-60846

Indicators of Compromise

Unexpected MWA Terminal Server process termination, restart loops, or hang states in Oracle E-Business Suite application-tier logs.
HTTP requests from high-privileged E-Business Suite accounts arriving from unusual source addresses or at unusual times.
Spikes in data read volume from Mobile Application Server database sessions that exceed baseline mobile client activity.

Detection Strategies

Alert on repeated crashes or hangs of the mwactl.sh managed MWA Terminal Server listener process on the E-Business Suite application tier.
Inspect Oracle HTTP Server access logs for anomalous request patterns targeting MWA endpoints, especially large payloads or malformed parameters.
Correlate authentication events for privileged E-Business Suite users with subsequent MWA Terminal Server errors to identify abuse chains.

Monitoring Recommendations

Enable and centralize logging for Oracle HTTP Server, MWA Terminal Server, and the underlying database audit trail for the APPS schema.
Monitor availability of the MWA Terminal Server listener port with synthetic checks so outages surface immediately.
Track privileged account usage in Oracle E-Business Suite and flag sessions that initiate MWA traffic outside approved business processes.

How to Mitigate CVE-2026-60846

Immediate Actions Required

Apply the fixes distributed in the Oracle July 2026 Critical Patch Update to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Restrict network access to the MWA Terminal Server so only trusted mobile clients and management hosts can reach the HTTP listener.
Review and reduce the number of high-privileged Oracle E-Business Suite accounts, and rotate credentials for any that were recently active.

Patch Information

Oracle addressed CVE-2026-60846 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for patch identifiers matching each affected 12.2.x release and apply them following Oracle E-Business Suite patching procedures.

Workarounds

Block inbound HTTP access to the MWA Terminal Server from untrusted network segments using firewall or reverse proxy rules until patches are applied.
Disable the MWA Terminal Server service on application tiers that do not require mobile client connectivity.
Enforce network segmentation between the Oracle E-Business Suite application tier and general corporate networks to limit reachability by authenticated but non-administrative users.

bash

# Configuration example: restrict MWA Terminal Server access at the OS firewall
# Replace <trusted_subnet> with the CIDR of authorized mobile client networks
iptables -A INPUT -p tcp --dport 10200 -s <trusted_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 10200 -j DROP