Oracle Managed File Transfer — CVE-2026-61003 (Critical)

Date Aug 18, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Oracle · Managed File Transfer

CVE CVE-2026-61003

Critical vendor advisory CVE-2026-61003

Summary

Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Managed File Transfer. While the vulnerability is in Oracle Managed File Transfer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Managed File Transfer. CVSS 3.1 Base Score 9.9 (Confidentiality,

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.9) in Oracle Managed File Transfer. Patch or mitigate promptly. EPSS percentile: 40%.

Operator check

Review CVE-2026-61003 in your asset inventory. Apply patches per vendor guidance and verify Managed File Transfer is not exposed. CVSS score: 9.9. EPSS probability: 0.5%; percentile: 40%.

Sources

NVD — CVE-2026-61003 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed