CVE-2026-83030 is a vulnerability in the Oracle Managed File Transfer product's MFT Runtime Server component affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows a low-privileged attacker with network access via T3 or IIOP protocols to perform unauthorized actions including creation, deletion, or modification of critical data, unauthorized read access to some data, and cause denial of service by hanging or crashing the service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H with a base score of 8.3, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

The vulnerability allows unauthorized actors with low privileges and network access to compromise Oracle Managed File Transfer, leading to unauthorized creation, deletion, or modification of critical data, unauthorized read access to some data, and denial of service conditions causing service hangs or crashes. This impacts confidentiality, integrity, and availability of the affected system.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Managed File Transfer versions 12.2.1.4.0 and 14.1.2.0.0 should apply these official patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability. No alternative mitigations or workarounds are indicated in the advisory.