This vulnerability affects Oracle Managed File Transfer (MFT) Runtime Server component in versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely by an attacker with low privileges over network protocols T3 and IIOP. Exploitation can result in unauthorized creation, deletion, or modification of critical or accessible data, unauthorized read access to a subset of data, and the ability to cause the service to hang or crash repeatedly, resulting in denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and high availability impact. Oracle has included fixes for this vulnerability in its September 2026 Critical Security Patch Update advisory.

Successful exploitation can lead to unauthorized modification, creation, or deletion of critical data within Oracle Managed File Transfer, unauthorized read access to some data, and denial of service conditions through hangs or crashes. This impacts confidentiality, integrity, and availability of the affected system.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Managed File Transfer versions 12.2.1.4.0 and 14.1.2.0.0 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates to mitigate this and other vulnerabilities. No alternative mitigations or workarounds are specified in the advisory.