EXPOSURES › CVE-2026-61003
CVE-2026-61003
CRITICALA critical remote code execution flaw in Oracle Managed File Transfer allows low-privileged attackers to take over the system via network access.
CVE-2026-61003 is a CVSS 9.9 vulnerability in Oracle Fusion Middleware's MFT Runtime Server that enables remote compromise with low privileges. DIB organizations must patch this immediately as it directly impacts data integrity and availability, and the scope change means adjacent systems could be affected. Failure to patch exposes the organization to full system takeover and potential data exfiltration.
Shame score — A critical RCE flaw in a widely deployed enterprise product that allows low-privileged attackers to take over systems represents a severe avoidable risk that DIB vendors must patch promptly to maintain trust.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Managed File Transfer. While the vulnerability is in Oracle Managed File Transfer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Managed File Transfer. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |