CVE-2026-60547: Oracle Managed File Transfer RCE Flaw

CVE-2026-60547 Overview

CVE-2026-60547 is a critical vulnerability in the Oracle Managed File Transfer (MFT) product within Oracle Fusion Middleware, specifically affecting the MFT Runtime Server component. Affected versions include 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access over HTTP can exploit the flaw to compromise Oracle MFT. The vulnerability carries a scope change, meaning successful exploitation can impact additional products beyond MFT itself. Oracle disclosed the issue in the Oracle Security Alert July 2026.

Critical Impact
Successful exploitation results in full takeover of Oracle Managed File Transfer with confidentiality, integrity, and availability impact, plus scope change affecting adjacent products.

Affected Products

Oracle Managed File Transfer 12.2.1.4.0
Oracle Managed File Transfer 14.1.2.0.0
Oracle Fusion Middleware — MFT Runtime Server component

Discovery Timeline

2026-07-21 - CVE CVE-2026-60547 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle publishes advisory in Oracle Security Alert July 2026

Technical Details for CVE-2026-60547

Vulnerability Analysis

CVE-2026-60547 affects the MFT Runtime Server, the core execution component that processes file transfer requests, workflows, and message routing in Oracle Managed File Transfer. The vulnerability is exploitable over HTTP and requires only low privileges. An authenticated attacker can leverage the flaw to gain full control of the MFT instance.

The scope change indicator signals that the vulnerability crosses trust boundaries. Compromise of MFT can pivot into other Oracle Fusion Middleware components that share integration channels, message queues, or credentials with MFT. Because MFT typically brokers sensitive file exchanges between partners, systems, and business units, takeover exposes stored files, transfer credentials, and downstream applications.

An EPSS score of 0.447% places the immediate probability of observed exploitation as low, though the technical impact remains severe for any exposed instance.

Root Cause

Oracle has not published the underlying CWE classification or detailed technical root cause. The advisory indicates the flaw resides within the MFT Runtime Server logic that handles authenticated HTTP requests. The scope-change attribute suggests the runtime executes in a context with permissions that extend beyond the MFT security boundary.

Attack Vector

The attack vector is network-based over HTTP. An attacker requires low-privileged credentials, which any authenticated MFT user or partner account may satisfy. No user interaction is required, and attack complexity is low. Exploitation directly targets the MFT Runtime Server endpoints exposed by the Fusion Middleware deployment. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical guidance.

Detection Methods for CVE-2026-60547

Indicators of Compromise

Unexpected administrative operations, workflow creations, or file transfer job modifications performed by low-privilege MFT accounts.
Anomalous outbound connections or file exfiltration originating from the MFT Runtime Server host.
New or modified deployment artifacts, scripts, or scheduled transfers appearing without change-control tickets.
Authentication events from unusual source IPs against MFT HTTP endpoints followed by privileged actions.

Detection Strategies

Baseline normal MFT Runtime Server HTTP request patterns and alert on deviations in endpoint usage, parameter length, or response codes.
Monitor Fusion Middleware audit logs for privilege changes, role assignments, and configuration edits performed by non-administrative accounts.
Correlate MFT authentication events with subsequent process, file, or network activity on the underlying WebLogic host.

Monitoring Recommendations

Forward WebLogic, MFT, and OS-level logs to a centralized analytics platform for continuous review.
Enable verbose auditing on MFT administrative and runtime endpoints, retaining logs for at least 90 days.
Alert on any process spawned by the WebLogic or MFT service account that is not part of the approved runtime baseline.

How to Mitigate CVE-2026-60547

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Managed File Transfer 12.2.1.4.0 and 14.1.2.0.0 deployments.
Restrict network access to MFT HTTP endpoints to trusted management networks and partner IP ranges only.
Rotate credentials for all MFT users, service accounts, and integration keys following patching.
Review MFT audit logs from before the patch date for signs of unauthorized privileged actions.

Patch Information

Oracle addressed CVE-2026-60547 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for the specific patch bundle, prerequisite versions, and installation guidance for each affected release.

Workarounds

Place Oracle MFT behind a web application firewall or reverse proxy with strict allowlists for HTTP endpoints and methods.
Enforce network segmentation so MFT Runtime Server cannot initiate outbound connections to arbitrary destinations.
Disable or remove unused MFT user accounts and enforce least-privilege role assignments for all remaining accounts until patches are applied.

bash

# Configuration example: restrict MFT Runtime Server exposure at the network edge
# Example iptables rules limiting inbound HTTP(S) to MFT to a management subnet
iptables -A INPUT -p tcp --dport 7003 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7003 -j DROP