What is the CVSS score of CVE-2026-60545?

CVE-2026-60545 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Managed File Transfer are affected by CVE-2026-60545?

Oracle Managed File Transfer (MFT) Runtime Server versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical account takeover vulnerability allowing authenticated users to fully compromise the system and…

How to fix or mitigate CVE-2026-60545?

Within 24 hours, identify all Oracle MFT Runtime Server instances running versions 12.2.1.4.0 or 14.1.2.0.0 and immediately restrict HTTP network access via firewall rules to administrative users only, disabling public or untrusted network exposure. Within 7 days, audit and revoke unnecessary low-privileged account access to MFT systems, implement network segmentation to isolate MFT servers from general user networks, and enable comprehensive audit logging for access and privilege escalation events. Over the next 30 days, monitor Oracle security advisories for patch availability and maintain documented preparedness to deploy updates immediately upon release; if patching remains unavailable beyond 30 days, escalate evaluation of alternative file transfer solutions for business-critical operations.

Managed File Transfer CVE-2026-60545

EUVD-2026-46907 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-mccj-7m64-x6wv

Oracle Authentication Bypass Managed File Transfer

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:57 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Managed File Transfer. Successful attacks of this vulnerability can result in takeover of Oracle Managed File Transfer. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle Managed File Transfer (MFT Runtime Server) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, authenticated attacker with network access over HTTP to fully compromise the product. Oracle rates the flaw CVSS 8.8 with high confidentiality, integrity, and availability impact and describes it as easily exploitable, but no public exploit has been identified at time of analysis and it is not listed in CISA KEV. The issue was disclosed by Oracle in the July 2026 Critical Patch Update.