EUVD-2026-61302
GHSA-qmm2-fcfg-cwvh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach MFT T3/IIOP listener with low privilege
-
DeliverySend crafted T3/IIOP request
-
ExploitExploit MFT Runtime Server flaw
-
ExecutionAchieve full MFT takeover
-
ImpactPivot to impacted adjacent products (scope change)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Oracle MFT Runtime Server's T3 or IIOP protocol listeners and a low level of existing privilege (CVSS PR:L) - it is not fully unauthenticated. No user interaction is required (UI:N) and attack complexity is low (AC:L). The practical limiting factors are: the attacker must reach the WebLogic T3/IIOP ports (commonly not exposed to the internet in hardened deployments) and must possess some low-privilege access; environments that firewall or connection-filter these proprietary protocols to trusted hosts are substantially harder to attack. Only versions 12.2.1.4.0 and 14.1.2.0.0 are stated as affected. |
| Impact | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes a low-friction, high-impact issue: network reachable, low complexity, only low privileges needed, no user interaction, and total confidentiality, integrity, and availability impact with a scope change. That combination drives the 9.9 score and warrants urgent treatment. However, this is not a PR:N unauthenticated flaw - the attacker needs some existing low-level privilege, which modestly limits mass exploitation to environments where the attacker already has a foothold or valid low-privilege access. There is no EPSS score, no POC, and no KEV listing in the provided data, so real-world exploitation is currently unproven; the score reflects potential impact rather than confirmed active abuse. The main uncertainty is what 'low privileged' means operationally for T3/IIOP access - verify with Oracle whether any authenticated WebLogic account suffices. |
| Exploit ScenarioDerived | An attacker holding a low-privileged account or foothold on a network segment that can reach the MFT server sends crafted requests over the T3 or IIOP protocol to the MFT Runtime Server. Because of the low attack complexity and scope change, the request drives full compromise of the MFT instance and can pivot to impact adjacent products. No public POC is identified at this time, but the WebLogic T3/IIOP attack surface is well-documented. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Full takeover of Oracle Managed File Transfer (Oracle Fusion Middleware, MFT Runtime Server) is possible when a low-privileged attacker with network access reaches the T3 or IIOP protocol interface. The flaw carries a CVSS 3.1 base score of 9.9 and, critically, involves a scope change (S:C) so successful attacks may significantly impact additional products beyond MFT itself. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity, low privilege requirement, and network exposure via WebLogic-style T3/IIOP make it a high-priority patch.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of August 2026 (https://www.oracle.com/security-alerts/cspuaug2026.html); patch available per vendor advisory, though the input does not specify an exact fixed build number, so obtain the precise patch for your 12.2.1.4.0 or 14.1.2.0.0 installation directly from the CPU matrix. As a compensating control until patched, restrict network access to the T3 and IIOP listener ports so only trusted management hosts can reach them - WebLogic supports T3/IIOP connection filters (weblogic.security.net.ConnectionFilterImpl) to allow-list source addresses, and firewalling these ports off from general and internet-facing networks sharply reduces exposure; the trade-off is that legitimate remote clustering, JMS, or remote-admin clients using those protocols must be explicitly permitted. Do not expose MFT T3/IIOP endpoints to the internet.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Managed File Transfer is a Fusion Middleware component built on the Oracle WebLogic Server stack; the affected element is the MFT Runtime Server. The named attack surface - T3 and IIOP - are the proprietary WebLogic remote protocols historically associated with unsafe Java deserialization and remote-object invocation weaknesses (CWE-502 class), which aligns with the scope-change and full-compromise outcome described here even though NVD lists no specific CWE. T3/IIOP are the RMI-style channels WebLogic uses for clustering and remote EJB/JMX access, and exposing them to untrusted networks is a well-known Fusion Middleware risk pattern. Affected releases are 12.2.1.4.0 and 14.1.2.0.0.
Know when Managed File Transfer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-facing T3/IIOP with low complexity and no interaction; requires low existing privilege (PR:L), and full takeover plus impact on other products justifies S:C and C/I/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Managed File Transfer. While the vulnerability is in Oracle Managed File Transfer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Managed File Transfer. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle Managed File Transfer (Fusion Middleware MFT Runtime Server) contains a critical vulnerability (CVE-2026-61003, CVSS 9.9) allowing authenticated users with low-level system access to achieve complete administrative control. The vulnerability's scope change means successful exploitation could compromise other interconnected systems beyond MFT itself. Organizations with MFT installations exposed to less-trusted networks face imminent risk of full infrastructure compromise.
No vendor-released patch identified at time of analysis. Implement immediate interim mitigations: strictly segment MFT network access using firewall rules limiting T3/IIOP ports to authorized administrative systems only; enforce role-based access controls on MFT to restrict low-privileged system access; implement security information and event management (SIEM) monitoring and alerting for suspicious authentication patterns and administrative actions; maintain detailed audit logs of all MFT access for forensic investigation; and prepare rapid-deployment capability for patching once the vendor releases a fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Managed File Transfer
View allThe payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-enco
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Privilege escalation to full product takeover in Oracle Managed File Transfer (versions 12.2.1.4.0 and 14.1.2.0.0), part
Full takeover of Oracle Managed File Transfer (MFT Runtime Server) is achievable by a low-privileged remote attacker ove
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contain
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 t
The fix for CVE-2020-9484 was incomplete. Rated high severity (CVSS 7.0).
Exploit-DB