CVE-2026-61003 is a critical, easily exploitable flaw in the Oracle Managed File Transfer MFT Runtime Server that lets a low-privileged attacker take over the product across a network. The CVE record was published 2026-08-18 and points to an Oracle Critical Patch Update advisory as its sole reference.
What Is It
CVE-2026-61003 is a vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware, specifically the MFT Runtime Server component. Oracle rates it CVSS 3.1 base score 9.9 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
The attack path is network access via the T3 and IIOP protocols. Oracle describes it as "easily exploitable"; attack complexity is low, no user interaction is required, and the attacker needs only low privileges to begin.
Why It Matters
Successful exploitation results in full takeover of Oracle Managed File Transfer, with high impact to confidentiality, integrity, and availability alike.
The scope is marked as changed, meaning Oracle warns that "attacks may significantly impact additional products." A scope change indicates that a compromise may not stay contained to MFT, it can potentially reach beyond the vulnerable component into the surrounding Fusion Middleware environment, though the supplied source material does not detail which adjacent components are reachable in practice. That scope change, combined with low privileges required, is what pushes the score to 9.9 rather than a contained 8.8.
Managed file transfer platforms sit on top of exactly the kind of data that makes a breach expensive: bulk business-to-business file flows, often between organizations.
There is no CISA KEV entry for CVE-2026-61003 in the supplied data, so active exploitation is not confirmed at this time.
What's Vulnerable
Per Oracle Corporation, the affected supported versions of Oracle Managed File Transfer are:
- 12.2.1.4.0
- 14.1.2.0.0
The vulnerable component is the MFT Runtime Server, reachable over T3 and IIOP.
Patch Status
The CVE record was published 2026-08-18 with NVD status "Received," and the only reference it carries is an Oracle Critical Patch Update advisory URL. Note that Oracle ships Critical Patch Updates on a fixed quarterly cadence, January, April, July, and October, so the fix for this issue belongs to a quarterly CPU release rather than a mid-quarter August cycle. Administrators running either affected version should follow the advisory link in the CVE record, confirm which CPU release carries the fix for their version, and apply the corresponding Fusion Middleware patch.
Until the patch is applied, restrict network reachability of the MFT Runtime Server's T3 and IIOP listeners to trusted hosts, since network access over those protocols is the stated attack vector.
No required-action deadline or remediation date is specified in the supplied source material, and no CISA KEV due date applies.
Sources
- NVD, CVE-2026-61003: https://nvd.nist.gov/vuln/detail/CVE-2026-61003
- Oracle Critical Patch Update advisory referenced by the CVE record: https://www.oracle.com/security-alerts/cpuaug2026.html