CVE-2026-83030

Received Received - Intake

Oracle Managed File Transfer Remote Code Execution

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Oracle

Description

Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Managed File Transfer. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Managed File Transfer accessible data as well as unauthorized read access to a subset of Oracle Managed File Transfer accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Managed File Transfer. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83030

EUVD

EUVD-2026-79358

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	managed_file_transfer	12.2.1.4.0
oracle	managed_file_transfer	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Managed File Transfer (part of Oracle Fusion Middleware) affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low-privileged attacker with network access to exploit weaknesses in the T3 or IIOP protocols to compromise the system.

Detection Guidance

Detection of CVE-2026-83030 requires monitoring Oracle Managed File Transfer for unusual network activity via T3 or IIOP protocols. Check for unauthorized data access, modification, or deletion attempts. Monitor for crashes or hangs in the MFT Runtime Server. Ensure low-privileged users are not making unexpected network requests to these ports.

Impact Analysis

An attacker could gain unauthorized access to create, delete, or modify critical data within Oracle Managed File Transfer. They could also read some data and cause the system to crash repeatedly, leading to a denial of service.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, which may violate GDPR (data protection) and HIPAA (health data privacy) requirements. Compliance could be compromised if sensitive data is exposed or altered.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle Managed File Transfer to address the vulnerability. Ensure network access via T3 and IIOP protocols is restricted to trusted sources only. Monitor for unusual activity in the Oracle Managed File Transfer system.

Hi! I’m here to help you understand CVE-2026-83030. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70