ZFS Storage Appliance CVE-2025-62476

Requires high-privilege (administrative, PR:H) authenticated access to the Oracle ZFS Storage Appliance Kit version 8.8, with network reachability to the HTTP-based management/Remote Replication interface. Exploitation targets the Remote Replication component specifically, so appliances using or exposing replication functionality are the relevant attack surface. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the mandatory administrative privilege is the dominant limiting factor - this cannot be exploited by an unauthenticated or low-privileged network attacker, which sharply narrows the realistic threat population to insiders or attackers who have already compromised appliance admin credentials.

This is a genuinely low-to-moderate real-world risk despite being a network-exploitable flaw. The CVSS 3.1 base score of 4.9 (Medium) is correctly bounded by two strong limiting factors in the vector: PR:H (high privileges required) and impact restricted to availability only (C:N/I:N/A:H). The CWE-400 (Uncontrolled Resource Consumption) classification and description converge cleanly - this is a complete DoS (hang or repeatable crash) of the Remote Replication component, with no confidentiality or integrity consequence. Exploitation signals reinforce low priority: EPSS is 0.33% (24th percentile), there is no CISA KEV listing, and no public exploit code was identified. SSVC-style reasoning: exploitation status is 'none' (no public exploit identified at time of analysis), automatable is effectively 'no' because the attacker must already hold high-privilege (administrative) access to the appliance, and technical impact is partial (availability-only, no code execution or data exposure). The one apparent tension - AV:N (network) combined with PR:H - is internally consistent for an admin-managed storage appliance whose management/replication interface is reached over HTTP but gated by administrative authentication; it is not a contradiction requiring vendor clarification. Net: a credible but low-urgency patch-cycle item, not an emergency.

An attacker who already possesses high-privilege (administrative) credentials to the Oracle ZFS Storage Appliance Kit sends crafted HTTP requests to the Remote Replication component over the network, triggering uncontrolled resource consumption that hangs or repeatedly crashes the appliance, producing a complete denial of service of storage replication. No public proof-of-concept or exploit code has been identified, and the required administrative privilege substantially limits the realistic threat population.