ZFS Storage Appliance CVE-2025-62475

Exploitation requires high-privileged (administrative-level) authenticated access to the Oracle ZFS Storage Appliance Kit 8.8 Core component, per CVSS PR:H - this is the primary limiting factor and rules out unauthenticated remote attackers. The attack is delivered over the network via HTTP (AV:N) against the Core component, needs no user interaction (UI:N), and has low attack complexity (AC:L) once the privilege prerequisite is met. The affected scope is limited to version 8.8; impact is confined to availability (service hang or repeatable crash), with no data exposure or modification. The need for pre-existing high privileges means realistic risk is largely bounded to malicious or compromised privileged accounts rather than opportunistic external attackers.

This is a moderate-severity, low-priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, base 4.9) shows the only impact is availability (A:H) - a complete denial of service - with no confidentiality or integrity impact. Critically, PR:H means the attacker must already hold high privileges on the appliance, which sharply limits the realistic threat: an attacker who already has administrative/high-privileged access could crash the box, but the pre-condition greatly narrows the viable attacker population. EPSS corroborates low real-world risk at 0.33% (25th percentile), indicating a low modeled probability of exploitation. There is no CISA KEV listing and no public exploit identified, so this is not confirmed to be actively exploited. CWE-400 (uncontrolled resource consumption) is consistent with the hang/repeatable-crash DOS described. One minor tension to note: the description calls this 'easily exploitable' (consistent with AC:L) yet also requires a high-privileged attacker (PR:H) - the 'easily exploitable' language refers to attack mechanics, not to a lack of authentication, so it should not be read as unauthenticated access.

An attacker who already possesses high-privileged (administrative-level) credentials on an Oracle ZFS Storage Appliance Kit 8.8 sends a crafted HTTP request to the Core component that triggers uncontrolled resource consumption, causing the appliance to hang or enter a repeatable crash loop (complete DOS). No public exploit code has been identified, and the attack is network-reachable but gated by the requirement for existing high privileges, making it most plausible as a privileged-insider or post-compromise action rather than an external break-in.