CVE-2026-60545: Oracle Managed File Transfer RCE Flaw

CVE-2026-60545 Overview

CVE-2026-60545 affects the Oracle Managed File Transfer (MFT) product within Oracle Fusion Middleware, specifically the MFT Runtime Server component. The flaw allows a low-privileged attacker with network access over HTTP to compromise the MFT instance. Successful exploitation results in full takeover of Oracle Managed File Transfer, impacting confidentiality, integrity, and availability. Oracle addressed the issue in its July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers with low privileges can remotely take over Oracle Managed File Transfer, exposing transferred files and enabling manipulation of enterprise file exchange workflows.

Affected Products

Oracle Managed File Transfer 12.2.1.4.0
Oracle Managed File Transfer 14.1.2.0.0
Oracle Fusion Middleware (MFT Runtime Server component)

Discovery Timeline

2026-07-21 - CVE-2026-60545 published to the National Vulnerability Database
2026-07-21 - Last updated in the NVD database
July 2026 - Oracle releases fix in the July 2026 Critical Patch Update

Technical Details for CVE-2026-60545

Vulnerability Analysis

CVE-2026-60545 resides in the MFT Runtime Server component of Oracle Managed File Transfer. Oracle classifies the flaw as easily exploitable over the network via HTTP. The attacker only needs low-level privileges and no user interaction. A successful attack yields complete compromise of the MFT product, meaning attackers can read, modify, or destroy files handled by the transfer platform.

Because Oracle MFT frequently brokers B2B file exchanges, EDI traffic, and internal system-to-system transfers, a takeover exposes sensitive data flowing between partners and downstream applications. Attackers can also stage the compromised MFT server for lateral movement into connected Fusion Middleware components.

Root Cause

Oracle has not publicly disclosed the underlying defect class. The advisory characterizes the issue as an easily exploitable server-side vulnerability in the MFT Runtime Server that permits privilege escalation to full product takeover. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical context.

Attack Vector

An attacker with valid low-privileged credentials sends crafted HTTP requests to the MFT Runtime Server over the network. The scope remains unchanged, but confidentiality, integrity, and availability impacts are all rated high. No user interaction is required, which makes exploitation viable against exposed management or runtime endpoints.

No verified public proof-of-concept code is available at this time. The EPSS probability of 0.447% places short-term exploitation likelihood in the 36th percentile, though authenticated Oracle Fusion Middleware flaws are historically targeted by advanced actors.

Detection Methods for CVE-2026-60545

Indicators of Compromise

Unexpected authenticated HTTP requests to MFT Runtime Server endpoints from non-administrative accounts.
Creation, modification, or deletion of transfer definitions, sources, or targets outside change windows.
New or altered files appearing in MFT payload directories that do not correlate with scheduled transfers.
Outbound connections initiated by the WebLogic or MFT managed server process to unknown hosts.

Detection Strategies

Review Oracle MFT audit logs for administrative actions executed by low-privileged user accounts.
Correlate WebLogic server access logs with MFT configuration changes to identify anomalous request sequences.
Alert on privilege changes and role assignments within the MFT console that occur without an approved ticket.

Monitoring Recommendations

Forward MFT and WebLogic logs to a centralized analytics platform with retention sufficient for incident review.
Baseline normal MFT transfer volumes and file counts, then alert on deviations that could indicate exfiltration.
Monitor process and network telemetry on hosts running MFT for unexpected child processes or shells.

How to Mitigate CVE-2026-60545

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle MFT 12.2.1.4.0 and 14.1.2.0.0 deployments.
Restrict network access to MFT Runtime Server HTTP interfaces to trusted management networks only.
Audit and rotate credentials for any low-privileged MFT accounts that may have been exposed.
Review MFT audit logs for suspicious activity dating back to before patch deployment.

Patch Information

Oracle published the fix in the July 2026 Critical Patch Update. Administrators should follow the vendor guidance in the Oracle Security Alert July 2026 and apply the patch to both supported versions 12.2.1.4.0 and 14.1.2.0.0.

Workarounds

Place the MFT Runtime Server behind a reverse proxy or web application firewall that enforces IP allowlisting.
Enforce least-privilege role assignments in MFT and remove unused accounts until patching completes.
Disable external-facing MFT HTTP listeners if they are not required for partner connectivity.

bash

# Configuration example: restrict MFT Runtime Server access at the network layer
# Example iptables rules limiting HTTP access to a trusted admin subnet
iptables -A INPUT -p tcp --dport 7003 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7003 -j DROP