CVE-2026-60846 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle E-Business Suite, specifically those with Oracle Mobile Application Server versions 12.2.3-12.2.15, should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of their Oracle E-Business Suite deployments.

Technical summary

The CVE-2026-60846 vulnerability is a highly exploitable issue in the Oracle Mobile Application Server product of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. A high privileged attacker with network access via HTTP can compromise the server, leading to unauthorized access to critical data, update, insert or delete access to some data, and complete DOS of Oracle Mobile Application Server. The CVSS 3.1 Base Score is 6.7, indicating a medium severity level. This issue is related to the MWA Terminal Server component.

Defensive priority

Medium priority given the CVSS score of 6.7 and the potential for unauthorized access to critical data, update, insert or delete access to some data, and complete DOS of Oracle Mobile Application Server.

Recommended defensive actions

• Inventory and verify affected Oracle E-Business Suite versions
• Apply vendor patches or updates as recommended by Oracle
• Implement compensating controls to restrict access to critical data
• Monitor for suspicious activity and implement logging and auditing
• Consider implementing additional security measures such as network segmentation
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-60846 vulnerability affects Oracle E-Business Suite, specifically the Oracle Mobile Application Server product, versions 12.2.3-12.2.15. It allows high privileged attackers with network access via HTTP to compromise the server, potentially leading to unauthorized access to critical data, data manipulation, and complete DOS. Evidence is limited to public sources and vendor advisories. Defenders should verify affected product deployments, review official advisories, and plan for vendor-supported updates or mitigations.

Official resources