Oracle Managed File Transfer vulnerabilities

20 CVEs affecting Oracle Managed File Transfer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-61003, published 2026-08-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2020-13935, published 2020-07-14. High severity, CVSS 7.5. EPSS: 86.6% chance of exploitation in the next 30 days. The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could…
CVE-2021-33037, published 2021-07-12. Medium severity, CVSS 5.3. EPSS: 74.7% chance of exploitation in the next 30 days. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request…
CVE-2020-13934, published 2020-07-14. High severity, CVSS 7.5. EPSS: 64.1% chance of exploitation in the next 30 days. An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of…
CVE-2020-9484, published 2020-05-20. High severity, CVSS 7.0. EPSS: 55.5% chance of exploitation in the next 30 days. When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;…
CVE-2021-25122, published 2021-03-01. High severity, CVSS 7.5. EPSS: 18.1% chance of exploitation in the next 30 days. When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body…
CVE-2018-1305, published 2018-02-23. Medium severity, CVSS 6.5. EPSS: 14.5% chance of exploitation in the next 30 days. Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded.…
CVE-2021-42340, published 2021-10-14. High severity, CVSS 7.5. EPSS: 11.8% chance of exploitation in the next 30 days. The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics…
CVE-2021-25329, published 2021-03-01. High severity, CVSS 7.0. EPSS: 9.5% chance of exploitation in the next 30 days. The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly…
CVE-2019-17359, published 2019-10-08. High severity, CVSS 7.5. EPSS: 9.1% chance of exploitation in the next 30 days. The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

Latest

CVE-2026-61003, published 2026-08-18. Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…
CVE-2026-60549, published 2026-07-21. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…
CVE-2026-60547, published 2026-07-21. Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…
CVE-2026-60545, published 2026-07-21. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…
CVE-2026-60537, published 2026-07-21. Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…
CVE-2022-23181, published 2022-01-27. High severity, CVSS 7.0. EPSS: 0.7% chance of exploitation in the next 30 days. The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed…