Oracle Managed File Transfer EUVD-2026-79358

Exploitation requires three concrete things: (1) network reachability to the Oracle Managed File Transfer MFT Runtime Server's WebLogic T3 or IIOP listener ports, which are typically bound to internal interfaces and should be firewalled to administration tiers; (2) a valid low-privileged account on the MFT/WebLogic domain - the CVSS vector is PR:L, so this is an authenticated attack, not unauthenticated, and the attacker must already possess working credentials; and (3) the MFT Runtime Server component must be running, i.e. the full MFT deployment rather than a standalone WebLogic instance. Limiting factors that reduce real-world risk: unauthenticated internet-facing exploitation is not possible under this vector, the T3/IIOP channels are frequently blocked or connection-filtered in hardened deployments, and no public exploit code or KEV confirmation was provided - so an attacker must either find or develop a working payload. Environments that expose T3/IIOP broadly and rely on shared or stale low-privilege credentials face the highest realistic exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) describes a network-reachable, low-complexity, no-user-interaction bug that requires only a low-privileged account - a fairly low bar in environments where contractors, integration accounts or compromised service credentials exist, and a mid-sized municipal IT team in rybnik running an on-prem MFT hub should treat this as urgent once they confirm the runtime is reachable. The high integrity and availability scores are the operationally meaningful part: an attacker who can rewrite or destroy file-transfer jobs could silently corrupt downstream business processes, and the repeatable crash gives an easy denial-of-service lever against a system that is often on the critical path for B2B data exchange. Important caveats: no CISA KEV entry means there is no confirmed active exploitation, and no EPSS score or public proof-of-concept was present in the supplied data, so this should be prioritized as a high-severity patch-now item rather than a panic incident. Exploitation is also bounded by network reachability of T3/IIOP, which in well-segmented deployments is restricted to internal tiers - environments that expose those ports broadly carry materially higher risk than those that do not. Where signals conflict is the missing CWE and the absent EPSS/KEV/POC metadata: we cannot distinguish a targeted, hard-to-automate exploit from a scriptable one, so treat the exploitability as unconfirmed rather than assumed.

An attacker who already holds a low-privileged account - a compromised service credential or a contractor login - connects directly to the MFT Runtime Server's T3 or IIOP listener from the network and sends crafted requests that the runtime fails to authorize properly. Within a single, low-complexity exchange the attacker can create, delete or modify transfer jobs, endpoints and payloads, exfiltrate a limited subset of MFT-accessible data, and then repeatedly trigger a crash to take the runtime down. No user interaction is required, and reachability of the internal T3/IIOP ports is the main practical gate.