CVE-2026-83029

Oracle Managed File Transfer (MFT), a component of Oracle Fusion Middleware, contains an easily exploitable broken access control flaw in the MFT Runtime Server affecting versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker holding only low-privileged (authenticated) credentials and network access via HTTP can trigger the flaw, and because the vulnerability carries a scope change, successful attacks may also significantly impact products beyond MFT itself. Exploitation gives the attacker unauthorized ability to create, delete, or modify critical data and full unauthorized read access to all data accessible through Oracle Managed File Transfer. Organizations running either affected version, particularly with the MFT Runtime Server reachable beyond internal trusted networks, are most at risk. No public proof-of-concept exists, the flaw is not on CISA's KEV list, and no in-the-wild exploitation has been reported to date.

What to do: Apply the current Oracle Critical Patch Update (CPU) to MFT Runtime Server on both 12.2.1.4.0 and 14.1.2.0.0, as Oracle remediates Fusion Middleware flaws through its quarterly CPU cycle. Until patched, restrict HTTP access to the MFT Runtime Server to trusted networks or VPN, and audit low-privileged MFT accounts for legitimacy and least privilege. Review MFT audit and transfer logs for unexpected data creation, deletion, modification, or reads attributable to low-privilege users, which could indicate attempted or successful exploitation.