CVE-2026-61003: Oracle Managed File Transfer Escalation

CVE-2026-61003 Overview

CVE-2026-61003 is a critical vulnerability in the Oracle Managed File Transfer (MFT) product within Oracle Fusion Middleware, specifically in the MFT Runtime Server component. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via the T3 or IIOP protocols can exploit this weakness to take over the MFT instance. The vulnerability introduces a scope change, meaning successful exploitation can significantly impact additional products beyond MFT itself. Oracle disclosed the issue in its August 2026 Critical Patch Update Advisory.

Critical Impact
Successful exploitation results in full takeover of Oracle Managed File Transfer with high impact to confidentiality, integrity, and availability across additional in-scope products.

Affected Products

Oracle Managed File Transfer 12.2.1.4.0
Oracle Managed File Transfer 14.1.2.0.0
Oracle Fusion Middleware deployments exposing T3 or IIOP endpoints

Discovery Timeline

2026-08-18 - CVE-2026-61003 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-61003

Vulnerability Analysis

The vulnerability resides in the MFT Runtime Server, the component that services file transfer protocol requests and orchestrates transfer workflows. Oracle categorizes the flaw as easily exploitable over the network by attackers holding low privileges. The attack surface is the WebLogic T3 and Internet Inter-ORB Protocol (IIOP) listeners that MFT inherits from its underlying Fusion Middleware stack. Because the vulnerability yields a scope change, an attacker who compromises MFT can pivot into other components sharing the WebLogic runtime, extending impact beyond the immediate product boundary. Oracle's advisory does not disclose the underlying weakness type; NVD lists it as NVD-CWE-noinfo.

Root Cause

Oracle has not published the specific root cause. Historically, similar T3/IIOP-reachable defects in Oracle Fusion Middleware have involved insecure deserialization of Java objects transmitted over these Remote Method Invocation (RMI) protocols. See the Oracle Security Alert for authoritative details.

Attack Vector

Exploitation requires network reachability to the WebLogic T3 or IIOP listener that fronts the MFT Runtime Server, and an authenticated low-privileged account. The attacker sends crafted protocol traffic to trigger the flaw and gain code execution or administrative control within the MFT runtime. Because T3 and IIOP are commonly bound to internal management ports, exposure of these ports to untrusted networks amplifies risk.

No public proof-of-concept code is available at this time. Refer to the vendor advisory for verified technical details.

Detection Methods for CVE-2026-61003

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 (7001/7002) or IIOP listeners from non-administrative sources.
New or modified deployments, MBeans, or scheduled jobs in the MFT Runtime Server without a corresponding change ticket.
Java process spawning shell interpreters (cmd.exe, /bin/sh) from the WebLogic managed server hosting MFT.
Anomalous outbound network traffic from the MFT host following T3/IIOP sessions.

Detection Strategies

Inspect WebLogic access and audit logs for T3/IIOP authentication attempts by low-privileged accounts followed by administrative actions.
Alert on Java deserialization error stacks in AdminServer.log and MFT managed server logs, which often accompany exploitation attempts.
Correlate process-lineage telemetry from the MFT host to identify child processes of the WebLogic JVM that are not part of normal file transfer operations.

Monitoring Recommendations

Ingest WebLogic and MFT audit logs into a centralized analytics platform and retain them for post-incident review.
Monitor the network perimeter for exposure of T3 and IIOP ports to any untrusted zone.
Track file integrity on MFT configuration directories and deployment paths for unauthorized modifications.

How to Mitigate CVE-2026-61003

Immediate Actions Required

Apply the fixes provided in the Oracle August 2026 Critical Patch Update to all MFT 12.2.1.4.0 and 14.1.2.0.0 instances.
Restrict T3 and IIOP protocol access to trusted management networks using WebLogic connection filters.
Rotate credentials for any low-privileged MFT and WebLogic accounts that could be abused to reach the runtime server.
Review MFT deployments, transfer definitions, and administrative user lists for unauthorized changes.

Patch Information

Oracle addressed CVE-2026-61003 in its August 2026 Critical Patch Update. Patches, affected version details, and installation instructions are documented in the Oracle Security Alert. Administrators should apply the update during the next available maintenance window and validate MFT service functionality afterward.

Workarounds

Configure WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP traffic from all networks except approved administrative subnets.
Place MFT management interfaces behind a bastion host or VPN to remove direct exposure from user and partner networks.
Disable IIOP on the MFT managed server if it is not required by integrated applications.

bash

# Example WebLogic connection filter rules restricting T3/IIOP to a management subnet
# Set in the WebLogic Admin Console: Security > Filter
10.10.20.0/24 * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops