This vulnerability affects Oracle Managed File Transfer (MFT) Runtime Server component in versions 12.2.1.4.0 and 14.1.2.0.0. It allows an attacker with low privileges and network access over HTTP to compromise the MFT product, potentially resulting in complete takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific issue. Oracle urges customers to remain on supported versions and apply patches without delay.

Successful exploitation can lead to full compromise of Oracle Managed File Transfer, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially leading to unauthorized data access, modification, or service disruption.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to mitigate vulnerabilities. However, the advisory does not explicitly confirm a patch or remediation for CVE-2026-60545 at this time. Customers should monitor Oracle's official security alerts and apply any relevant patches as soon as they become available. Until a patch is confirmed, no specific workaround or temporary fix is documented by the vendor.