ZFS Storage Appliance CVE-2025-62479

Exploitation requires the attacker to already hold a high-privileged (administrative) account on the Oracle ZFS Storage Appliance Kit 8.8 and network access to the appliance's HTTP management interface targeting the Block Storage component. No end-user interaction is needed (UI:N), but the PR:H requirement is the key limiting factor: this is not remotely exploitable by an unauthenticated attacker. Only version 8.8 is listed as affected, and the outcome is confined to a partial denial of service - no confidentiality or integrity impact - which further limits realistic risk to availability degradation by an insider or an attacker who has already escalated to admin.

This is a low-priority issue, not a high-CVSS-but-low-real-risk case - the signals are consistent and all point low. The CVSS 3.1 base score is only 2.7 (LOW), reflecting that the attack requires high privileges (PR:H) and yields only a partial availability impact (A:L) with no confidentiality or integrity impact (C:N/I:N). The EPSS score of 0.29% (19th percentile) confirms a low exploitation probability, consistent with the modest CVSS. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or opportunistic exploitation. CWE-267 (Privilege Defined With Unsafe Actions) aligns with the description's requirement that the attacker already hold high privileges, meaning the practical value of exploitation is limited - an already-privileged operator triggering a partial denial of service against the appliance they administer. No SSVC decision data was provided in the input. The main caveat: the CVSS vector lists AV:N (network via HTTP) while PR:H means the attacker must already be an authenticated high-privileged user, so real-world risk is bounded by pre-existing admin access rather than open network exposure.

An authenticated administrator or an attacker who has already compromised high-privileged credentials on an Oracle ZFS Storage Appliance Kit 8.8 sends a crafted HTTP request to the Block Storage component to trigger a partial denial of service. The impact is limited to degrading availability of the appliance; no data is read or altered. No public proof-of-concept exploit exists at time of analysis.