Threats affecting pkg:maven/com.oracle.mft/managed-file-transfer

A critical vulnerability exists in Oracle Managed File Transfer (MFT) Runtime Server affecting versions 12.2.1.4.0 and 14.1.2.0.0. This flaw allows a low-privileged attacker with network access via HTTP to compromise the MFT product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 9.6, indicating high confidentiality and integrity impacts. Oracle has released security patches addressing this issue as part of its September 2026 Critical Security Patch Update.