What is the CVSS score of CVE-2026-16606?

CVE-2026-16606 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 1.1%.

How to fix or mitigate CVE-2026-16606?

Within 24 hours, inventory all Fujitsu openFT deployments and confirm affected versions (pre-12.1D00); isolate or air-gap critical instances where possible and restrict network access to known trusted sources only. Within 7 days, implement real-time network monitoring for suspicious connections to openFT services, enable comprehensive audit logging, establish direct contact with Fujitsu support to confirm patch timeline, and assess data flows through openFT to prioritize which systems pose greatest compromise risk. Within 30 days, evaluate alternative secure file transfer solutions as contingency, develop a staged patch deployment plan for immediate application when Fujitsu releases version 12.1D00 or later, and conduct security testing on patched systems before returning to production.

Fujitsu openFT CVE-2026-16606

EUVD-2026-47729 CRITICAL

Code Injection (CWE-94)

2026-07-22 FTI

GHSA-49p9-fpjh-rwcr

RCE Code Injection Oracle Linux Openft Oracle Solaris Openft Fujitsu

9.3

CVSS 4.0 · Vendor: FTI

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach exposed openFT service over network
Delivery

Send crafted file-transfer request
Exploit

Trigger CWE-94 code injection in daemon
Execution

Execute arbitrary code pre-authentication
Impact

Full compromise of host (C/I/A)

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The vulnerable component is the openFT file-transfer service itself; the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no special conditions - remote unauthenticated exploitation is possible against default network-facing deployments of Fujitsu Linux openFT and Oracle Solaris openFT before 12.1D00. What limits exploitation is network reachability: the attacker must be able to reach the openFT listening service, so instances confined to segmented internal networks, VPNs, or partner-only firewall allowlists are substantially harder to reach, and any host running version 12.1D00 or later is not affected. Platform is limited to the GNU/Linux and Oracle Solaris openFT builds.
Impact	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) is internally consistent with the description of pre-auth RCE: network-reachable, low complexity, no privileges, no user interaction, and full loss of confidentiality, integrity, and availability on the vulnerable system with no scope change to downstream systems. This is a genuinely high-priority issue on raw exploitability signals - the hardest metric, privileges, is PR:N. Mitigating the urgency: no EPSS score is provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no POC is referenced, so exploitation remains theoretical for now. No SSVC decision data was supplied, so automatability cannot be assessed from the input. Net: treat as a serious patch-now vulnerability because of pre-auth network RCE, while recognizing that real-world exploitation evidence is currently absent from the available data.
Exploit ScenarioDerived	An attacker with network access to an exposed openFT service on a Linux or Solaris host sends a crafted request that injects code into a context the daemon interprets and executes, gaining code execution with the service's privileges before any authentication takes place. No credentials, no user interaction, and only low attack complexity are required, so an internet- or partner-network-exposed openFT server could be compromised directly. No public POC is referenced, so an attacker would need to develop the exploit independently.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 1.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Remote code execution in Fujitsu openFT managed file transfer software (Linux and Oracle Solaris variants) before version 12.1D00 lets remote attackers run arbitrary code without authentication (pre-auth RCE) over the network. The flaw is a CWE-94 code injection carrying a CVSS 4.0 base score of 9.3, and the CVSS vector confirms it needs no privileges and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the pre-auth, network-reachable nature makes it a high-priority patch target.

RemediationAI

Vendor-released patch: upgrade Linux openFT and Oracle Solaris openFT to version 12.1D00 or later, which is the fixed release identified in the description and Fsas Technologies PSIRT advisory (FsasTech-PSIRT-FTI-FG-2026-042411). Consult the security notice PDF at https://security.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-FG-2026-042411-Security-Notice.pdf and the download portal at https://security.eu.fsastech.com/IndexDownload.asp?SoftwareGuid=20873292-0006-4a1c-a188-3940762a0075 for the exact packages. Until the upgrade is deployed, restrict network reachability of the openFT service by firewalling its listening port to only known, trusted file-transfer partners and placing the host behind a segmented network or VPN, accepting that this breaks connectivity with any partner not on the allowlist; if a given host does not require inbound openFT connections, stop or disable the openFT daemon to remove the exposure entirely at the cost of file-transfer availability.

Affected VersionsENISA

Linux openFT patch: 12.1D00

Oracle Solaris openFT 0 ≤12.1C95

Linux openFT 0 ≤12.1C96

Affected Packages

euvd linux_openft no fix

euvd oracle_solaris_openft no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

openFT is Fujitsu's enterprise managed file transfer (MFT) product, historically tied to the BS2000 mainframe ecosystem and its Linux/Solaris integration components (referenced by the vendor's mainframe-solutions and BS2000-integration pages). The two affected CPEs - cpe:2.3:a:fujitsu:linux_openft and cpe:2.3:a:fujitsu:oracle solaris_openft - indicate the vulnerable code ships in both the GNU/Linux and Oracle Solaris server distributions. The root cause is classified as CWE-94 (Improper Control of Generation of Code / 'Code Injection'), meaning attacker-supplied input reaches a context where it is interpreted and executed as code rather than treated as inert data; combined with the network attack vector, this yields unauthenticated remote code execution in the file-transfer daemon.

Know when Linux Openft gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (FTI) PRIMARY 9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today AI 9.8 CRITICAL

Pre-auth network RCE gives AV:N/AC:L/PR:N/UI:N with full C/I/A impact; scope unchanged as impact stays on the vulnerable host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (FTI).

CVSS VectorVendor: FTI

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.

Executive ViewAI

Why It Matters

Fujitsu openFT, a critical enterprise file transfer platform, contains an unauthenticated remote code execution vulnerability affecting versions before 12.1D00 with no vendor patch currently available. Attackers can execute arbitrary code over the network without credentials, creating immediate risk to confidentiality and integrity of data transiting through file transfer infrastructure. Organizations using openFT require urgent mitigation until patches are released.

Business Impact: Severe

Compensating Controls

Implement network segmentation to restrict openFT access to dedicated, monitored zones; enforce strict firewall rules limiting inbound connections to explicitly trusted sources only; enable comprehensive transaction and access logging with centralized SIEM integration; consider reverse proxy or API gateway deployment in front of openFT to add additional authentication and inspection layers; temporarily redirect non-critical file transfers to alternative secure solutions until patched; establish 24/7 monitoring for exploitation indicators once Fujitsu or security vendors release detection signatures.

Threat Intelligence Overview

EPSS Score

1.1%

Top 37% exploitable

Prevalence

Low

niche enterprise/mainframe-adjacent managed file transfer product, limited deployment footprint

Social Media

Sightings

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 1.1%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.