This vulnerability affects Oracle Managed File Transfer within Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling compromise of the MFT product. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data accessible via Oracle MFT. The vulnerability also has a scope change, potentially impacting additional Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality and integrity impacts without availability impact. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Managed File Transfer. The attacker can gain unauthorized access to all data accessible by Oracle MFT, potentially compromising confidentiality and integrity of sensitive information. The vulnerability's scope change indicates that additional Oracle products may also be affected indirectly. The CVSS score of 9.6 reflects a critical severity with high impact on confidentiality and integrity.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.