This vulnerability affects Oracle Managed File Transfer (MFT) Runtime Server component in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling compromise of the MFT product. Successful exploitation can lead to full takeover of the Oracle Managed File Transfer system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm a patch or remediation level for these versions.

The vulnerability allows an attacker with low privileges and network access via HTTP to compromise Oracle Managed File Transfer, resulting in complete takeover of the system. This includes full loss of confidentiality, integrity, and availability of the affected product. The high CVSS score (8.8) reflects the critical nature of the impact on the affected system.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a patch or remediation for Oracle Managed File Transfer versions 12.2.1.4.0 and 14.1.2.0.0. Customers are strongly advised to monitor the Oracle Critical Patch Update documentation and apply patches promptly once they become available. Until an official patch is confirmed, no specific workaround or temporary fix is documented. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.