CVE-2026-60537: Oracle Managed File Transfer RCE Flaw

CVE-2026-60537 Overview

CVE-2026-60537 is a critical vulnerability in the Oracle Managed File Transfer (MFT) product within Oracle Fusion Middleware. The flaw resides in the MFT Runtime Server component and affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access over HTTP can exploit the issue to fully compromise Oracle MFT. Because the vulnerability carries a scope change, successful exploitation can impact additional products beyond MFT itself. Oracle addressed the flaw in the July 2026 Critical Patch Update.

Critical Impact
Authenticated network attackers can achieve complete takeover of Oracle Managed File Transfer, with cascading impact on connected systems due to scope change.

Affected Products

Oracle Managed File Transfer 12.2.1.4.0
Oracle Managed File Transfer 14.1.2.0.0
Oracle Fusion Middleware deployments running the MFT Runtime Server

Discovery Timeline

2026-07-21 - CVE-2026-60537 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Oracle Critical Patch Update

Technical Details for CVE-2026-60537

Vulnerability Analysis

The vulnerability affects the MFT Runtime Server, the core component that processes file transfer requests, executes transfer workflows, and manages protocol handlers. Oracle Managed File Transfer is an enterprise-grade platform for exchanging files between internal and external systems, and it typically holds credentials, transfer artifacts, and integration points to downstream applications.

Exploitation requires only low privileges and network access over HTTP. The scope change indicator means the vulnerable component can affect resources beyond its own security boundary, exposing integrated Fusion Middleware services. Successful exploitation results in full compromise of confidentiality, integrity, and availability. The EPSS probability sits at 0.447%.

Root Cause

Oracle has not published detailed root-cause information beyond the advisory. The combination of low attack complexity, low required privileges, network reachability over HTTP, and full impact across confidentiality, integrity, and availability is consistent with a server-side flaw in an authenticated HTTP handler within the MFT Runtime Server. Refer to the Oracle Critical Patch Update - July 2026 for vendor-provided technical detail.

Attack Vector

An attacker holding any low-privileged MFT account sends crafted HTTP requests to the MFT Runtime Server endpoint. Because the vulnerability produces a scope change, the resulting compromise extends beyond MFT to adjacent Fusion Middleware components that trust MFT. This enables lateral movement into integrated business systems, exfiltration of files in transit, and manipulation of transfer workflows. Public proof-of-concept code is not available at the time of publication.

No verified exploit code is publicly available. See the Oracle Critical Patch Update for vendor guidance.

Detection Methods for CVE-2026-60537

Indicators of Compromise

Unexpected HTTP requests to MFT Runtime Server endpoints from low-privileged accounts
New or modified file transfer workflows, endpoints, or scheduled transfers not initiated by administrators
Outbound connections from the MFT host to unfamiliar internal or external systems
Anomalous authentication events on integrated Fusion Middleware services following MFT activity

Detection Strategies

Audit MFT administrative and runtime logs for privilege escalation patterns and unusual API calls
Correlate MFT HTTP access logs with downstream Fusion Middleware authentication events to spot scope-crossing activity
Monitor for creation of new MFT users, roles, or transfer configurations outside change windows
Baseline normal MFT traffic volume and alert on deviations in request rate or payload size

Monitoring Recommendations

Forward MFT Runtime Server, WebLogic, and OS logs to a centralized SIEM for correlation
Enable HTTP request logging with full URI and user context on MFT endpoints
Track process creation and outbound network connections from the MFT host
Review privileged account usage on integrated systems that trust the MFT service account

How to Mitigate CVE-2026-60537

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected MFT deployments as the first priority
Inventory all Oracle MFT instances at versions 12.2.1.4.0 and 14.1.2.0.0 and confirm patch status
Restrict network access to the MFT Runtime Server to trusted management networks and required partners
Review and reduce the number of accounts with any level of MFT access

Patch Information

Oracle addressed CVE-2026-60537 in the July 2026 Critical Patch Update. Administrators must apply the patch bundle referenced in the Oracle Critical Patch Update Advisory for Oracle Fusion Middleware. Patching is the only vendor-supported remediation.

Workarounds

Place the MFT Runtime Server behind a web application firewall configured to inspect HTTP traffic to MFT endpoints
Enforce network segmentation between MFT and downstream Fusion Middleware components to limit scope-change impact
Rotate credentials and API keys stored within MFT after patching to invalidate any material that may have been exposed
Disable or remove low-privileged MFT accounts that are not actively required for operations

bash

# Verify Oracle MFT version prior to patching
cd $MW_HOME/mft
cat VERSION.txt

# Restrict MFT Runtime Server exposure at the network layer
iptables -A INPUT -p tcp --dport 7500 -s <trusted_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 7500 -j DROP