Managed File Transfer CVE-2026-60545

Oracle Managed File Transfer (MFT) Runtime Server versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical account takeover vulnerability allowing authenticated users to fully compromise the system and intercept or manipulate file transfers. Organizations using affected MFT versions face immediate risk of data exfiltration, unauthorized access to sensitive files, and business continuity disruption, particularly in compliance-regulated industries. With no patch currently available, rapid implementation of network access restrictions is essential to prevent exploitation.

Within 24 hours, identify all Oracle MFT Runtime Server instances running versions 12.2.1.4.0 or 14.1.2.0.0 and immediately restrict HTTP network access via firewall rules to administrative users only, disabling public or untrusted network exposure. Within 7 days, audit and revoke unnecessary low-privileged account access to MFT systems, implement network segmentation to isolate MFT servers from general user networks, and enable comprehensive audit logging for access and privilege escalation events. Over the next 30 days, monitor Oracle security advisories for patch availability and maintain documented preparedness to deploy updates immediately upon release; if patching remains unavailable beyond 30 days, escalate evaluation of alternative file transfer solutions for business-critical operations.

No vendor-released patch identified at time of analysis. Interim mitigations: restrict HTTP network access to MFT servers to authorized administrators only via firewall rules; implement network segmentation to isolate MFT systems from general user networks; audit and revoke unnecessary low-privileged account access to MFT environments; enable comprehensive audit logging for all access attempts and privilege escalation events; prioritize HTTPS over HTTP where available; disable non-critical MFT Runtime Server instances until a patch is released. Monitor Oracle Critical Patch Updates monthly for patch availability.