A vulnerability in Oracle Managed File Transfer (MFT) Runtime Server affects versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low-privileged attacker with network access via T3 or IIOP protocols to compromise the MFT product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, unauthorized read access to some data, and denial of service through hangs or crashes. The vulnerability has a CVSS 3.1 base score of 8.3, indicating high severity. Oracle has released security patches addressing this vulnerability in their September 2026 Critical Security Patch Update. Users are strongly advised to apply these patches promptly.