What is the CVSS score of CVE-2026-60547?

CVE-2026-60547 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Managed File Transfer are affected by CVE-2026-60547?

Oracle Managed File Transfer (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to privilege escalation resulting in complete product compromise and potential impact to connected Oracle Fusion…

How to fix or mitigate CVE-2026-60547?

Within 24 hours, identify all systems running Oracle MFT versions 12.2.1.4.0 or 14.1.2.0.0 and assess HTTP network exposure. Within 7 days, apply Oracle July 2026 Critical Patch Update to all production instances and verify patch deployment. Within 30 days, complete patching across development and test systems, review audit logs for exploitation indicators, and implement network access restrictions on MFT HTTP components.

Oracle Managed File Transfer CVE-2026-60547

EUVD-2026-46909 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-rq7v-897v-r3xx

Authentication Bypass Oracle Managed File Transfer

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network HTTP vector with low complexity, requires a low-privilege account (PR:L), no interaction, and breaks scope (S:C) yielding full C/I/A takeover per Oracle.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:56 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Managed File Transfer. While the vulnerability is in Oracle Managed File Transfer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Managed File Transfer. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation to full product takeover in Oracle Managed File Transfer (versions 12.2.1.4.0 and 14.1.2.0.0), part of Oracle Fusion Middleware's MFT Runtime Server component, allows a low-privileged attacker with HTTP network access to compromise the product and, because of a scope change, significantly impact additional connected products. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CVSS 3.1 base score of 9.9 and the easily-exploitable, low-privilege nature make this a top-priority Critical Patch Update item. The flaw is addressed in the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle Managed File Transfer (MFT) is an enterprise B2B/managed file-transfer platform built on Oracle Fusion Middleware, typically deployed on WebLogic Server; the affected element is the MFT Runtime Server, the HTTP-facing component that processes transfer requests and orchestrates file movement between endpoints. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates a network-reachable weakness exploitable over HTTP by an already-authenticated low-privilege account, where a successful exploit breaks out of MFT's own security boundary (S:C, scope change) to affect other Fusion Middleware components sharing the same runtime or trust context. No CWE was supplied by Oracle or NVD, so the precise root-cause class (e.g., improper authorization, deserialization, or SSRF/path handling common in MFT runtimes) cannot be confirmed from the available data; Oracle's tag 'Information Disclosure' hints at a confidentiality-exposing weakness even though the CVSS records full C/I/A impact.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to affected Oracle Managed File Transfer 12.2.1.4.0 and 14.1.2.0.0 deployments; Oracle publishes exact patch/bundle-patch numbers per Fusion Middleware release inside the CPU advisory (Patch available per vendor advisory - no standalone fix version was included in this input). Until patched, reduce exposure by restricting network reachability of the MFT Runtime Server HTTP endpoints to trusted management networks or VPN only, tightening WebLogic/MFT account provisioning to eliminate unnecessary low-privilege accounts (since PR:L is the sole barrier), and placing a WAF or reverse proxy in front of the runtime to filter anomalous HTTP requests; note these controls constrain administration convenience and do not neutralize the underlying flaw, so patching remains mandatory. Given the scope change, also review and segment adjacent Fusion Middleware components that share trust with the MFT runtime.