Oracle Managed File Transfer CVE-2026-60549

Exploitation requires network access to the MFT Runtime Server over HTTP and a low-privileged authenticated account on Oracle Managed File Transfer (CVSS PR:L), against affected versions 12.2.1.4.0 or 14.1.2.0.0. No user interaction is required (UI:N) and attack complexity is low (AC:L), and Oracle explicitly labels it 'easily exploitable.' The primary limiting factor is the authentication requirement: a fully anonymous, unauthenticated attacker cannot exploit it directly - some valid low-privilege credential or foothold is needed. Real-world exposure is highest where the MFT Runtime Server HTTP interface is reachable from the internet or from a large population of semi-trusted users; instances confined to isolated internal networks are meaningfully harder to reach.

This is a genuine priority for organizations running MFT. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) indicates remote HTTP exploitation with low complexity, no user interaction, and only low privileges required, yielding complete compromise of the product. Oracle itself characterizes it as 'easily exploitable,' which aligns with AC:L. No EPSS score, SSVC decision, KEV listing, or POC was supplied, so probability-of-exploitation and automatability signals are unavailable; absence of those signals is not evidence of low risk, particularly given that Oracle MFT is an attractive target (it brokers sensitive file transfers) and prior Oracle MFT CVEs have drawn attacker interest. The main mitigating factor is the PR:L requirement - an attacker needs at least low-privileged authenticated access, so this is not fully anonymous, unauthenticated RCE. Net: high real-world risk where MFT is internet-exposed or reachable by semi-trusted users, moderated by the authentication prerequisite.

An attacker who has obtained a low-privileged MFT/WebLogic account - via phishing, credential reuse, or an insider - sends a crafted HTTP request to the internet-reachable MFT Runtime Server. Because exploitation is low-complexity and needs no user interaction, the request results in full takeover of the MFT instance, giving the attacker access to transferred files and control over the transfer service. No public exploit code has been identified at time of analysis.