Managed File Transfer
Monthly
Full takeover of Oracle Managed File Transfer (Oracle Fusion Middleware, MFT Runtime Server) is possible when a low-privileged attacker with network access reaches the T3 or IIOP protocol interface. The flaw carries a CVSS 3.1 base score of 9.9 and, critically, involves a scope change (S:C) so successful attacks may significantly impact additional products beyond MFT itself. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity, low privilege requirement, and network exposure via WebLogic-style T3/IIOP make it a high-priority patch.
Full compromise of Oracle Managed File Transfer (MFT Runtime Server) allows a low-privileged, network-authenticated attacker to take over the product via HTTP, per Oracle's July 2026 Critical Patch Update. The flaw affects Fusion Middleware MFT versions 12.2.1.4.0 and 14.1.2.0.0, carries a CVSS 8.8 with full confidentiality, integrity, and availability impact, and is rated by Oracle as 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation to full product takeover in Oracle Managed File Transfer (versions 12.2.1.4.0 and 14.1.2.0.0), part of Oracle Fusion Middleware's MFT Runtime Server component, allows a low-privileged attacker with HTTP network access to compromise the product and, because of a scope change, significantly impact additional connected products. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CVSS 3.1 base score of 9.9 and the easily-exploitable, low-privilege nature make this a top-priority Critical Patch Update item. The flaw is addressed in the Oracle July 2026 Critical Patch Update.
Account takeover in Oracle Managed File Transfer (MFT Runtime Server) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, authenticated attacker with network access over HTTP to fully compromise the product. Oracle rates the flaw CVSS 8.8 with high confidentiality, integrity, and availability impact and describes it as easily exploitable, but no public exploit has been identified at time of analysis and it is not listed in CISA KEV. The issue was disclosed by Oracle in the July 2026 Critical Patch Update.
Full takeover of Oracle Managed File Transfer (MFT Runtime Server) is achievable by a low-privileged remote attacker over HTTP in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this CVSS 9.9 because the flaw carries a scope change, so a successful attack can also significantly impact products beyond MFT itself. No public exploit has been identified at time of analysis; the fix ships in the Oracle July 2026 Critical Patch Update.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.
The fix for CVE-2020-9484 was incomplete. Rated high severity (CVSS 7.0).
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Memory Leak vulnerability could allow attackers to exhaust available memory leading to denial of service.
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;. Rated high severity (CVSS 7.0). This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Vulnerability in the Oracle Managed File Transfer component of Oracle Fusion Middleware (subcomponent: MFT Runtime Server). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Full takeover of Oracle Managed File Transfer (Oracle Fusion Middleware, MFT Runtime Server) is possible when a low-privileged attacker with network access reaches the T3 or IIOP protocol interface. The flaw carries a CVSS 3.1 base score of 9.9 and, critically, involves a scope change (S:C) so successful attacks may significantly impact additional products beyond MFT itself. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity, low privilege requirement, and network exposure via WebLogic-style T3/IIOP make it a high-priority patch.
Full compromise of Oracle Managed File Transfer (MFT Runtime Server) allows a low-privileged, network-authenticated attacker to take over the product via HTTP, per Oracle's July 2026 Critical Patch Update. The flaw affects Fusion Middleware MFT versions 12.2.1.4.0 and 14.1.2.0.0, carries a CVSS 8.8 with full confidentiality, integrity, and availability impact, and is rated by Oracle as 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation to full product takeover in Oracle Managed File Transfer (versions 12.2.1.4.0 and 14.1.2.0.0), part of Oracle Fusion Middleware's MFT Runtime Server component, allows a low-privileged attacker with HTTP network access to compromise the product and, because of a scope change, significantly impact additional connected products. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CVSS 3.1 base score of 9.9 and the easily-exploitable, low-privilege nature make this a top-priority Critical Patch Update item. The flaw is addressed in the Oracle July 2026 Critical Patch Update.
Account takeover in Oracle Managed File Transfer (MFT Runtime Server) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, authenticated attacker with network access over HTTP to fully compromise the product. Oracle rates the flaw CVSS 8.8 with high confidentiality, integrity, and availability impact and describes it as easily exploitable, but no public exploit has been identified at time of analysis and it is not listed in CISA KEV. The issue was disclosed by Oracle in the July 2026 Critical Patch Update.
Full takeover of Oracle Managed File Transfer (MFT Runtime Server) is achievable by a low-privileged remote attacker over HTTP in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this CVSS 9.9 because the flaw carries a scope change, so a successful attack can also significantly impact products beyond MFT itself. No public exploit has been identified at time of analysis; the fix ships in the Oracle July 2026 Critical Patch Update.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.
The fix for CVE-2020-9484 was incomplete. Rated high severity (CVSS 7.0).
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Memory Leak vulnerability could allow attackers to exhaust available memory leading to denial of service.
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;. Rated high severity (CVSS 7.0). This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Vulnerability in the Oracle Managed File Transfer component of Oracle Fusion Middleware (subcomponent: MFT Runtime Server). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.