What is the CVSS score of CVE-2026-60549?

CVE-2026-60549 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Managed File Transfer are affected by CVE-2026-60549?

Oracle Managed File Transfer (MFT) Runtime Server versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical flaw enabling authenticated users to achieve full system compromise, including complete data…

How to fix or mitigate CVE-2026-60549?

Within 24 hours, identify all systems running Oracle MFT versions 12.2.1.4.0 and 14.1.2.0.0 and apply network-layer restrictions to allow access only from pre-approved internal systems via firewall rules; simultaneously audit recent file transfer logs and authentication records for indicators of compromise. Within 7 days, deploy enhanced monitoring and alerting for authentication events, file operations, and system-level changes on affected MFT instances, and contact Oracle to confirm patch availability timelines and interim guidance. Within 30 days, implement network segmentation to isolate MFT servers from external networks and less-trusted internal segments, establish a formal vendor communication cadence for patch status updates, and evaluate operational alternatives such as temporary service suspension or traffic rerouting pending patch availability.

Oracle Managed File Transfer CVE-2026-60549

EUVD-2026-46911 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-9m3h-4942-cwfh

Authentication Bypass Oracle Managed File Transfer

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP vector with low complexity and no user interaction; a low-privileged account is required (PR:L), and full product takeover yields high C/I/A within an unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:43 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Managed File Transfer. Successful attacks of this vulnerability can result in takeover of Oracle Managed File Transfer. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Managed File Transfer (MFT Runtime Server) allows a low-privileged, network-authenticated attacker to take over the product via HTTP, per Oracle's July 2026 Critical Patch Update. The flaw affects Fusion Middleware MFT versions 12.2.1.4.0 and 14.1.2.0.0, carries a CVSS 8.8 with full confidentiality, integrity, and availability impact, and is rated by Oracle as 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Managed File Transfer is an enterprise Fusion Middleware component used to securely transfer large files between internal systems and external partners, typically deployed on WebLogic Server as part of SOA/integration stacks. The affected element is the MFT Runtime Server, the HTTP-facing service that processes transfer requests. Oracle does not assign a CWE (listed as N/A) and its CPU advisories intentionally omit root-cause detail, but the combination of network HTTP vector, low-privilege requirement, and full C/I/A 'takeover' impact is characteristic of an authenticated flaw (e.g., injection, deserialization, or authorization bypass) in the runtime request-handling path. Exact affected products come from Oracle/EUVD version data rather than CPE strings, which were not provided.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative source of the patched bundle for MFT 12.2.1.4.0 and 14.1.2.0.0; Oracle CPUs deliver security fixes as cumulative quarterly patches rather than a single named point release, so the specific fix version is not independently confirmed from the provided data and must be taken from the CPU patch matrix for your platform. Until patching, reduce exposure by restricting network access to the MFT Runtime Server HTTP endpoints so they are reachable only from trusted management networks (not the public internet), placing MFT behind a WAF or reverse proxy with request filtering, and tightening account provisioning so low-privileged MFT/WebLogic accounts are minimized and monitored - the trade-off is that partner-facing or externally integrated transfer workflows may break if access is over-restricted, so validate legitimate partner IP ranges before blocking. Increase logging and alerting on MFT runtime requests to detect exploitation attempts during the patch window.