Oracle MFT CVE-2026-83029

Requires a valid low-privileged account (PR:L) and network HTTP access to the Oracle MFT Runtime Server component of Oracle Fusion Middleware versions 12.2.1.4.0 or 14.1.2.0.0; no user interaction is needed and attack complexity is low. The limiting factors are the authentication requirement (attacker must already possess at least minimal credentials) and product-specific exposure - the MFT HTTP runtime must be reachable by the attacker. The scope change (S:C) means successful exploitation is not confined to MFT and may impact additional Oracle products, raising blast radius. No special non-default feature toggle is documented because Oracle's advisory provides no technical detail.

This is a genuinely high-priority vulnerability whose 9.6 CVSS score is well-calibrated rather than inflated. The vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) describes an easily exploitable, network-reachable flaw needing only low privileges and no user interaction, with a scope change that can 'significantly impact additional products' beyond MFT itself. The full confidentiality and integrity impact (read plus create/delete/modify of all MFT-accessible data) is credible for a managed file-transfer runtime that brokers sensitive data flows; the honest omission of availability impact (A:N) indicates a measured, not exaggerated, score. However, the exploitation-likelihood signals are entirely absent: no CISA KEV listing, no public POC, and no EPSS score are provided, so there is currently no evidence of active or imminent exploitation. The main tension is that the input tag 'Authentication Bypass' conflicts with the vector's PR:L, which requires an authenticated low-privileged account - this is an authenticated abuse-of-access issue, not an unauthenticated bypass. Oracle's CPU advisory (cspusep2026) publishes no technical detail, so root cause and CWE are unknown, which limits confidence in any deeper mechanism claims. Net: treat as a real priority for patching due to low attack complexity, scope change, and full C/I impact, but the realistic near-term threat is bounded by the authentication requirement and the current absence of any exploit evidence.

An attacker who holds any low-privileged account on an internet- or network-reachable Oracle MFT deployment sends crafted HTTP requests to the MFT Runtime Server to read, alter, or destroy file-transfer data and, via the scope change, pivot impact into adjacent Oracle products. Because attack complexity is low and no user interaction is needed, exploitation is straightforward once minimal credentials are obtained (e.g., via phishing, credential reuse, or a low-tier service account). No public exploit code has been identified at time of analysis, so exploitation would currently require independent development.