ZFS Storage Appliance CVE-2025-62478

Exploitation requires the attacker to already hold HIGH privileges on the appliance (CVSS PR:H - administrative/high-privileged account) and network access over HTTP to the Object Store component of Oracle ZFS Storage Appliance Kit version 8.8. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the high-privilege prerequisite is the dominant limiting factor: an unprivileged or anonymous remote attacker cannot trigger this. Impact is confined to availability (service hang or repeatable crash / complete DOS); there is no data disclosure or modification. The requirement for pre-existing administrative access makes this primarily an insider or post-compromise threat.

This is a genuinely low-to-moderate priority issue despite its CRITICAL-adjacent product context. The CVSS 3.1 base score is 4.9 (MEDIUM), driven solely by availability impact (A:H) with no confidentiality or integrity effect (C:N/I:N). The vector AV:N/AC:L/PR:H/UI:N shows network reachability and low attack complexity, but critically requires HIGH privileges (PR:H) - an attacker must already hold administrative/high-privileged access to the appliance before triggering the flaw, which sharply limits the realistic threat population to insiders or already-compromised admin sessions. The EPSS score of 0.33% (25th percentile) corroborates a low likelihood of near-term exploitation. The vulnerability is NOT listed in CISA KEV and no public exploit code is identified, so there is no confirmed active exploitation. All signals are internally consistent: a medium-severity, privilege-gated denial-of-service bug (CWE-400 resource exhaustion) with low exploitation probability. The only qualifier is that Oracle's advisory style describes impact tersely and self-reports CVSS; the vector and description align (high-privileged attacker, HTTP, DOS outcome), so no contradiction is present. Prioritize patching during the normal Oracle CPU cycle rather than as an emergency.

An attacker who has already obtained high-privileged (administrative) access to the Oracle ZFS Storage Appliance Kit sends crafted HTTP requests to the Object Store component, triggering uncontrolled resource consumption that hangs or repeatedly crashes the appliance, producing a complete denial of service. No public exploit code is identified, and the required high privilege level means the scenario is most plausible for a malicious insider or an attacker who has already compromised an administrator account.