CVE-2026-70732: Oracle Mobile App Server Info Disclosure

CVE-2026-70732 Overview

CVE-2026-70732 is an information disclosure vulnerability in the Oracle Mobile Application Server component of Oracle E-Business Suite, specifically within the MWA Terminal Server. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit this vulnerability without user interaction. Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible through the Oracle Mobile Application Server. Oracle disclosed this issue in its August 2026 Critical Patch Update Security Alert.

Critical Impact
Authenticated attackers can remotely read sensitive data processed by Oracle Mobile Application Server, exposing business-critical E-Business Suite content over HTTP.

Affected Products

Oracle E-Business Suite — Oracle Mobile Application Server, version 12.2.3
Oracle E-Business Suite — Oracle Mobile Application Server, versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Mobile Application Server, version 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70732 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70732

Vulnerability Analysis

The vulnerability resides in the MWA Terminal Server component of Oracle Mobile Application Server, which handles mobile client requests within Oracle E-Business Suite. The MWA Terminal Server exposes network-accessible functionality over HTTP that improperly enforces access controls on sensitive data. An attacker holding low-privilege credentials can craft requests that return data beyond their authorized scope.

The attack surface is fully network-reachable and requires no user interaction. The scope is unchanged, meaning the impact is confined to the vulnerable component, but confidentiality impact is high across all data reachable by the service. Integrity and availability are not affected.

EPSS currently rates the probability of exploitation at 0.27% with a percentile of 19.323, indicating limited observed exploit activity at publication time. No public proof-of-concept, exploit code, or CISA KEV listing exists for this issue as of the latest NVD update.

Root Cause

Oracle has not published detailed root cause information in the public advisory. Based on the CVSS metrics and component context, the flaw involves insufficient authorization enforcement within the MWA Terminal Server request handling path, allowing an authenticated low-privileged session to retrieve data associated with other principals or protected objects. See the Oracle Security Alert for authoritative technical detail available to licensed customers.

Attack Vector

Exploitation proceeds over the network using HTTP against an exposed MWA Terminal Server instance. The attacker authenticates with any low-privilege account and issues crafted requests to component endpoints that return data without adequately validating the caller's authorization. No user interaction and no elevated privileges are required. The absence of a public PoC does not eliminate risk, since Oracle E-Business Suite deployments are common targets for post-authentication data theft.

No verified exploitation code is available. See the Oracle Security Alert for vendor-supplied remediation instructions.

Detection Methods for CVE-2026-70732

Indicators of Compromise

Anomalous HTTP request volume to MWA Terminal Server endpoints from a single authenticated account, especially outside normal business hours.
Access log entries showing a low-privilege user retrieving records or datasets outside their assigned responsibilities or organizations.
Repeated parameter manipulation patterns (identifier enumeration, sequential IDs) in Oracle Mobile Application Server request logs.

Detection Strategies

Correlate authenticated E-Business Suite session data with MWA Terminal Server access logs to identify volume-based data access anomalies.
Baseline expected MWA endpoint usage per user role and alert on deviations, particularly on responses returning large payloads.
Ingest Oracle EBS application and HTTP server logs into a centralized analytics platform and apply behavioral rules to detect enumeration or scraping patterns.

Monitoring Recommendations

Enable verbose auditing on the Oracle Mobile Application Server tier and forward logs to a SIEM for retention and correlation.
Monitor egress traffic from EBS application servers for unusual outbound volume that could indicate staged exfiltration following data access.
Track authentication events for low-privilege EBS accounts and flag lateral pivots to MWA-related URIs.

How to Mitigate CVE-2026-70732

Immediate Actions Required

Apply the August 2026 Oracle Critical Patch Update Security Alert to all Oracle E-Business Suite instances running Mobile Application Server versions 12.2.3 through 12.2.15.
Inventory all internet-exposed MWA Terminal Server endpoints and restrict them to trusted network segments while patching is scheduled.
Rotate credentials and review recent access logs for low-privilege EBS accounts that could have been used to exploit the flaw.

Patch Information

Oracle addressed CVE-2026-70732 in the August 2026 Critical Patch Update Security Alert. Refer to the Oracle Security Alert for the specific patch identifiers, prerequisite technology stack updates, and installation procedures applicable to your Oracle E-Business Suite version. Customers must apply patches following Oracle's documented order to avoid regression.

Workarounds

Remove or firewall the MWA Terminal Server service if mobile terminal functionality is not required in your deployment.
Restrict HTTP access to the MWA Terminal Server to VPN or internal network ranges using network-level ACLs or a reverse proxy.
Enforce least-privilege on all Oracle E-Business Suite accounts, removing unnecessary responsibilities that grant MWA access.

bash

# Configuration example: restrict MWA Terminal Server access at the network edge
# iptables example limiting HTTP access to a trusted management subnet
iptables -A INPUT -p tcp --dport 10200 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 10200 -j DROP