This vulnerability affects Oracle Managed File Transfer within Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It permits an attacker with low privileges and network access over T3 or IIOP to compromise the product, potentially resulting in full takeover. The vulnerability also has scope change implications, meaning it can significantly affect other Oracle products beyond MFT. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability as part of its August 2026 Critical Security Patch Update (CSPU).

Exploitation of this vulnerability can lead to complete compromise of Oracle Managed File Transfer, including full control over the product. Due to scope change, other Oracle products may also be significantly impacted. The high CVSS score (9.9) reflects critical impacts on confidentiality, integrity, and availability, potentially allowing attackers to access sensitive data, alter or disrupt services, and take over the affected system.

Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to the affected Oracle Managed File Transfer versions 12.2.1.4.0 and 14.1.2.0.0. Oracle recommends remaining on actively-supported versions and applying security patches without delay to mitigate this critical risk.