ZFS Storage Appliance CVE-2025-62480

Exploitation requires an attacker who already holds HIGH privileges (PR:H) on the Oracle ZFS Storage Appliance Kit version 8.8 and who can reach the appliance's HTTP management interface over the network. The specific target is the Naming Subsystem component. Limiting factors: the high-privilege prerequisite means the attacker must already be an authenticated administrative-level user, so this is not an initial-access flaw; the maximum impact is a PARTIAL denial of service (A:L) with no confidentiality or integrity effect; and only version 8.8 is listed as affected. Fixed via the Oracle October 2025 Critical Patch Update.

This is a genuinely low-risk vulnerability, and every signal agrees. The CVSS 3.1 base score of 2.7 reflects an availability-only impact (C:N/I:N/A:L) that is further gated by PR:H - the attacker must already hold high privileges on the appliance. The best achievable outcome is a partial denial of service, not full compromise or crash. EPSS is 0.29% (19th percentile), indicating low predicted exploitation likelihood, and there is no CISA KEV listing and no public proof-of-concept, so exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reasoning: technical impact is partial (not total), and while the vector is network-reachable (AV:N) and low-complexity (AC:L), the high-privilege prerequisite makes it non-automatable against arbitrary targets. No signals conflict. CWE-267 (Privilege Defined With Unsafe Actions) is somewhat unusual for a pure DoS outcome, but this is consistent with a privileged operator being able to misuse an administrative action in the Naming Subsystem to degrade service rather than escalate; it is not a contradiction worth overriding the vendor vector. The only attacker who benefits is one who already has HTTP management access with high privileges, for whom degrading availability is a marginal gain.

An attacker who has already obtained high-privileged administrative access to the Oracle ZFS Storage Appliance Kit (version 8.8) management interface sends a crafted HTTP request to the Naming Subsystem to trigger a partial denial of service, degrading availability of the storage appliance. No public proof-of-concept or active exploitation is known, and the high-privilege requirement means this is a post-compromise nuisance rather than an initial-access vector.