This vulnerability affects Oracle Managed File Transfer (MFT) Runtime Server component in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by a low privileged attacker over the network via HTTP, allowing compromise of the MFT product. The vulnerability has a critical CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability. The scope of the vulnerability extends beyond MFT, potentially impacting other Oracle products. The vendor advisory references a Critical Patch Update released in July 2026 but does not explicitly confirm a patch for this specific vulnerability. Customers are urged to apply available patches promptly as per Oracle's general guidance.

Successful exploitation can lead to complete takeover of Oracle Managed File Transfer, affecting confidentiality, integrity, and availability of the system. The vulnerability's scope change means that other Oracle products integrated or dependent on MFT may also be impacted. This represents a critical risk to affected environments.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly. Until a specific patch is confirmed, monitor Oracle advisories for updates and consider restricting network access to Oracle Managed File Transfer instances to trusted sources only.