ZFS Storage Appliance CVE-2025-62477

Exploitation requires an attacker to already hold HIGH privileges (administrative access) on the Oracle ZFS Storage Appliance Kit 8.8 and network HTTP access to the Remote Replication component. The decisive limiting factor is PR:H - this is not remotely exploitable by an unauthenticated attacker; it presupposes a privileged/administrative foothold on the appliance. Attack complexity is low (AC:L) and no user interaction is needed once privileged access is held. Only version 8.8 is listed as affected, and impact is limited to availability (service hang/crash) with no data exposure or modification.

This is a moderate-severity availability-only vulnerability (CVSS 3.1 base 4.9) in the Remote Replication component of the Oracle ZFS Storage Appliance Kit. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) shows network-reachable, low-complexity exploitation but requires HIGH privileges (PR:H) - meaning the attacker must already hold administrative/high-privilege access to the appliance, which substantially limits the real-world threat population to insiders or attackers who have already compromised privileged credentials. Impact is confined to availability (complete DOS via hang or repeatable crash); there is no confidentiality or integrity impact (C:N/I:N). The EPSS score of 0.33% (25th percentile) indicates low predicted exploitation probability, consistent with a non-KEV, availability-only flaw requiring high privileges. This is NOT in CISA KEV and no public exploit is identified. On balance this is a lower-priority issue: the high-privilege precondition and DOS-only impact mean it does not warrant emergency patching for most environments, though it should be remediated in normal Oracle CPU cadence. The CVSS and EPSS signals are consistent (both pointing to limited real-world risk); no conflicting signals were observed in the provided data.

An attacker who has already obtained high-privilege (administrative) credentials on an Oracle ZFS Storage Appliance sends crafted HTTP requests to the Remote Replication component, triggering uncontrolled resource consumption (CWE-400) that hangs or repeatedly crashes the appliance, producing a complete denial of service. No public exploit code has been identified, and exploitation presupposes privileged access rather than anonymous network reach.