External risk intelligence

Oracle Managed File Transfer Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-60537

Oracle Managed File Transfer (MFT) is an enterprise integration product designed for file exchange between external systems and internal networks. Given its role as a transfer hub, it is commonly deployed as an internet-facing or partner-facing service to facilitate data exchange across organizational boundaries.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Managed File Transfer, a component within Oracle Fusion Middleware. This issue could allow a low-privileged attacker with network access to gain control of the system, potentially impacting other connected products. The high severity score indicates significant risks to confidentiality, integrity, and availability.

A critical flaw in Oracle file transfer software.
It impacts systems handling external data exchanges.
Confirm if this transfer system is in use.

Attack Path

How an attacker could exploit the issue

An attacker with network access can target the Oracle Managed File Transfer component. If successful, this vulnerability allows a low-privileged attacker to take over the Oracle Managed File Transfer system, potentially impacting other connected products.

Network access via HTTP required.
Vulnerable MFT Runtime Server component.
Full system takeover possible.

Live Threat

Current exploitation, exposure, and threat context

A low-privileged attacker with network access could compromise Oracle Managed File Transfer. This vulnerability could allow for a complete takeover of the Oracle Managed File Transfer system, potentially impacting other connected products.

Oracle Managed File Transfer system.
Low-privileged attacker via HTTP.
Takeover of Oracle Managed File Transfer.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Oracle Managed File Transfer (MFT) product is likely managed by application owners or a dedicated platform team, as it facilitates critical file exchanges. Initial triage requires identifying all MFT instances, assessing their network exposure and business criticality, and confirming the accountable owner before planning remediation.

Application or platform teams own this.
Verify MFT reachability and criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Managed File Transfer?

Oracle Managed File Transfer is part of Oracle Fusion Middleware. It serves as a central hub for businesses to securely exchange files between internal applications and external partners or systems, acting as a bridge to move data reliably across different network environments.

How does CVE-2026-60537 affect system security?

This vulnerability allows an attacker to gain unauthorized control over the MFT Runtime Server. It is a critical flaw where a successful compromise results in full system takeover, meaning an attacker could read, modify, or delete the data being processed and potentially move laterally to impact other integrated systems.

Do I need to be an administrator to trigger CVE-2026-60537?

No, you do not need administrative rights. The vulnerability can be triggered by an attacker who already holds a low-privileged account on the system. They must have network access via HTTP to reach the MFT service; it cannot be triggered without this specific network connectivity.

Is my system at risk if it is internet-facing?

Yes, if your MFT instances are internet-facing, they are more accessible to potential attackers. Halo Surface Signal identifies this as an external risk because these systems are designed to interact with outside entities, making them primary candidates for network-based attacks rather than being isolated to internal-only traffic.

What should I do first to address this vulnerability?

Begin by inventorying all instances of Oracle Managed File Transfer in your environment. Determine which teams own these systems, assess their specific network reachability, and consult the latest security alerts from Oracle to prepare for the appropriate software updates or configuration changes.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.