EUVD-2026-46909
GHSA-rq7v-897v-r3xx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged MFT account
-
DeliverySend crafted HTTP request to MFT Runtime Server
-
ExploitExploit MFT Runtime Server flaw
-
ExecutionTake over MFT instance
-
ImpactPivot to adjacent Fusion Middleware products (scope change)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the MFT Runtime Server's HTTP interface and a valid low-privileged account on Oracle Managed File Transfer (CVSS PR:L - this is the primary limiting factor; it is not a pre-authentication flaw). No user interaction is needed (UI:N) and attack complexity is low (AC:L), and Oracle labels it 'easily exploitable.' It applies to Oracle MFT versions 12.2.1.4.0 and 14.1.2.0.0 in their supported configurations; no special non-default feature toggle is named in the description. The scope change (S:C) means a successful compromise is not confined to MFT but can reach additional connected Fusion Middleware products, which raises impact but does not add a precondition. |
| Impact | All confirmed signals point to genuine high priority: CVSS 3.1 is 9.9 with AV:N (network), AC:L (low complexity), PR:L (only low privileges), UI:N (no user interaction), and S:C with full High confidentiality, integrity, and availability impact - Oracle explicitly describes it as 'easily exploitable' resulting in 'takeover.' The single mitigating factor is PR:L: the attacker must hold some authenticated foothold (any low-privilege MFT/WebLogic account), which slightly narrows exposure versus a pure pre-auth flaw. No EPSS score, no POC, and no CISA KEV listing were provided, so exploitation-in-the-wild is not established - the priority here is driven by intrinsic exploitability and impact rather than by observed attacks. The 'Information Disclosure' tag mildly conflicts with the full C/I/A takeover framing in the CVSS vector; treat the CVSS/description as authoritative and the tag as an incomplete label. Because Oracle bundles this in a quarterly CPU, patch quickly regardless of the absent EPSS/KEV data. |
| Exploit ScenarioDerived | An attacker who has obtained any low-privileged Oracle MFT account (via phishing, credential reuse, or an insider) sends crafted HTTP requests to the MFT Runtime Server over the network, requiring no user interaction, and leverages the flaw to take over the MFT instance. Because of the scope change, the attacker then pivots into additional Fusion Middleware products, exfiltrating transferred files and manipulating or disrupting file-transfer operations. No public POC has been identified at time of analysis, so exploitation would currently require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Privilege escalation to full product takeover in Oracle Managed File Transfer (versions 12.2.1.4.0 and 14.1.2.0.0), part of Oracle Fusion Middleware's MFT Runtime Server component, allows a low-privileged attacker with HTTP network access to compromise the product and, because of a scope change, significantly impact additional connected products. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CVSS 3.1 base score of 9.9 and the easily-exploitable, low-privilege nature make this a top-priority Critical Patch Update item. The flaw is addressed in the Oracle July 2026 Critical Patch Update.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to affected Oracle Managed File Transfer 12.2.1.4.0 and 14.1.2.0.0 deployments; Oracle publishes exact patch/bundle-patch numbers per Fusion Middleware release inside the CPU advisory (Patch available per vendor advisory - no standalone fix version was included in this input). Until patched, reduce exposure by restricting network reachability of the MFT Runtime Server HTTP endpoints to trusted management networks or VPN only, tightening WebLogic/MFT account provisioning to eliminate unnecessary low-privilege accounts (since PR:L is the sole barrier), and placing a WAF or reverse proxy in front of the runtime to filter anomalous HTTP requests; note these controls constrain administration convenience and do not neutralize the underlying flaw, so patching remains mandatory. Given the scope change, also review and segment adjacent Fusion Middleware components that share trust with the MFT runtime.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Managed File Transfer (MFT) is an enterprise B2B/managed file-transfer platform built on Oracle Fusion Middleware, typically deployed on WebLogic Server; the affected element is the MFT Runtime Server, the HTTP-facing component that processes transfer requests and orchestrates file movement between endpoints. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates a network-reachable weakness exploitable over HTTP by an already-authenticated low-privilege account, where a successful exploit breaks out of MFT's own security boundary (S:C, scope change) to affect other Fusion Middleware components sharing the same runtime or trust context. No CWE was supplied by Oracle or NVD, so the precise root-cause class (e.g., improper authorization, deserialization, or SSRF/path handling common in MFT runtimes) cannot be confirmed from the available data; Oracle's tag 'Information Disclosure' hints at a confidentiality-exposing weakness even though the CVSS records full C/I/A impact.
Know when Managed File Transfer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network HTTP vector with low complexity, requires a low-privilege account (PR:L), no interaction, and breaks scope (S:C) yielding full C/I/A takeover per Oracle.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Managed File Transfer. While the vulnerability is in Oracle Managed File Transfer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Managed File Transfer. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle Managed File Transfer (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to privilege escalation resulting in complete product compromise and potential impact to connected Oracle Fusion Middleware systems. An HTTP-accessible attacker with low privileges can achieve full takeover, directly threatening file transfer operations and dependent infrastructure. A vendor patch is available but requires urgent deployment.
Apply vendor patch: Oracle July 2026 Critical Patch Update. If patching cannot be completed immediately, restrict HTTP network access to MFT Runtime Server through firewall and network segmentation, enhance monitoring for unauthorized privilege escalation attempts, and increase audit logging on file transfer operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Managed File Transfer
View allThe payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-enco
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Full takeover of Oracle Managed File Transfer (Oracle Fusion Middleware, MFT Runtime Server) is possible when a low-priv
Full takeover of Oracle Managed File Transfer (MFT Runtime Server) is achievable by a low-privileged remote attacker ove
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contain
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 t
The fix for CVE-2020-9484 was incomplete. Rated high severity (CVSS 7.0).
Exploit-DB