ZFS Storage Appliance CVE-2025-62289

Exploitation requires the attacker to hold HIGH administrative privileges on the Oracle ZFS Storage Appliance Kit (version 8.8) and network access to its HTTP management interface, per the CVSS PR:H/AV:N metrics; the malicious request targets the Filesystems component. The principal limiting factor is the privilege requirement: an attacker must already be authenticated as a high-privileged operator, so this is not remotely exploitable by an anonymous or low-privileged user. Impact is confined to availability (hang or repeatable crash / complete DoS) with no data disclosure or modification, and only version 8.8 is listed as affected.

This is a moderate-severity, availability-only issue that does not rise to urgent-priority status. The CVSS 3.1 base score is 4.9 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - network attack vector and low complexity, but critically requiring HIGH privileges (PR:H) and causing only availability impact (A:H) with no confidentiality or integrity loss. The EPSS score is low at 0.31% (22nd percentile), indicating low modeled probability of exploitation in the near term. The CVE is NOT listed in CISA KEV and no public proof-of-concept was identified in the provided data, so there is no evidence of active exploitation. No SSVC decision data was supplied. The signals are internally consistent: a DoS flaw that an already-privileged user can trigger is a low real-world priority - the PR:H requirement means an attacker must first hold administrative-level credentials on the appliance, substantially limiting the realistic threat population to insiders or attackers who have already compromised privileged access. Note the CWE-267 (Privilege Defined With Unsafe Actions) classification is somewhat atypical for a pure DoS and suggests the issue stems from a privileged operation being misused; this is worth verifying against Oracle's advisory detail.

An attacker who already possesses high-privileged (administrative) access to the Oracle ZFS Storage Appliance Kit management interface sends a crafted HTTP request to the Filesystems component, triggering a hang or repeatable crash that produces a complete denial of service of the storage appliance. No public exploit code was identified, and because high privileges are required, the scenario is primarily an insider-threat or post-compromise action rather than opportunistic remote exploitation.