This vulnerability affects Oracle Managed File Transfer (MFT) Runtime Server component in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges who has network access via HTTP, allowing them to compromise the MFT product. The attack can result in complete takeover of the Oracle Managed File Transfer system and may also affect other Oracle products due to scope change. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes security patches addressing this vulnerability among others, though no explicit patch version for MFT is provided in the input data.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Oracle Managed File Transfer, resulting in complete takeover. This includes high confidentiality, integrity, and availability impacts. Additionally, the vulnerability's exploitation may affect other Oracle products beyond MFT due to scope change.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability along with many others. Users of Oracle Managed File Transfer versions 12.2.1.4.0 and 14.1.2.0.0 should promptly review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches as instructed. Patch status is not explicitly detailed in the provided data, so checking the vendor advisory for current patch availability and installation guidance is essential. No alternative mitigations or workarounds are specified.