Which versions of Fujitsu openFT are affected by CVE-2026-16606?

Fujitsu openFT, a critical enterprise file transfer platform, contains an unauthenticated remote code execution vulnerability affecting versions before 12.1D00 with no vendor patch currently…

How to fix or mitigate CVE-2026-16606?

Within 24 hours, inventory all Fujitsu openFT deployments and confirm affected versions (pre-12.1D00); isolate or air-gap critical instances where possible and restrict network access to known trusted sources only. Within 7 days, implement real-time network monitoring for suspicious connections to openFT services, enable comprehensive audit logging, establish direct contact with Fujitsu support to confirm patch timeline, and assess data flows through openFT to prioritize which systems pose greatest compromise risk. Within 30 days, evaluate alternative secure file transfer solutions as contingency, develop a staged patch deployment plan for immediate application when Fujitsu releases version 12.1D00 or later, and conduct security testing on patched systems before returning to production.

Fujitsu openFT CVE-2026-16606

Q: What is the CVSS score of CVE-2026-16606?

CVE-2026-16606 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.1%.

EUVD-2026-47729 CRITICAL

Code Injection (CWE-94)

2026-07-22 FTI

GHSA-49p9-fpjh-rwcr

RCE Code Injection Oracle Linux Openft Oracle Solaris Openft Fujitsu

9.3

CVSS 4.0 · Vendor: FTI

Severity by source

Vendor (FTI) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Pre-auth network RCE gives AV:N/AC:L/PR:N/UI:N with full C/I/A impact; scope unchanged as impact stays on the vulnerable host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (FTI).

CVSS VectorVendor: FTI

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 15:45 vuln.today

CVE Published

Jul 22, 2026 - 15:14 cve.org

CRITICAL 9.3

DescriptionCVE.org

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.

AnalysisAI

Remote code execution in Fujitsu openFT managed file transfer software (Linux and Oracle Solaris variants) before version 12.1D00 lets remote attackers run arbitrary code without authentication (pre-auth RCE) over the network. The flaw is a CWE-94 code injection carrying a CVSS 4.0 base score of 9.3, and the CVSS vector confirms it needs no privileges and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the pre-auth, network-reachable nature makes it a high-priority patch target.

Technical ContextAI

openFT is Fujitsu's enterprise managed file transfer (MFT) product, historically tied to the BS2000 mainframe ecosystem and its Linux/Solaris integration components (referenced by the vendor's mainframe-solutions and BS2000-integration pages). The two affected CPEs - cpe:2.3:a:fujitsu:linux_openft and cpe:2.3:a:fujitsu:oracle solaris_openft - indicate the vulnerable code ships in both the GNU/Linux and Oracle Solaris server distributions. The root cause is classified as CWE-94 (Improper Control of Generation of Code / 'Code Injection'), meaning attacker-supplied input reaches a context where it is interpreted and executed as code rather than treated as inert data; combined with the network attack vector, this yields unauthenticated remote code execution in the file-transfer daemon.

RemediationAI

Vendor-released patch: upgrade Linux openFT and Oracle Solaris openFT to version 12.1D00 or later, which is the fixed release identified in the description and Fsas Technologies PSIRT advisory (FsasTech-PSIRT-FTI-FG-2026-042411). Consult the security notice PDF at https://security.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-FG-2026-042411-Security-Notice.pdf and the download portal at https://security.eu.fsastech.com/IndexDownload.asp?SoftwareGuid=20873292-0006-4a1c-a188-3940762a0075 for the exact packages. Until the upgrade is deployed, restrict network reachability of the openFT service by firewalling its listening port to only known, trusted file-transfer partners and placing the host behind a segmented network or VPN, accepting that this breaks connectivity with any partner not on the allowlist; if a given host does not require inbound openFT connections, stop or disable the openFT daemon to remove the exposure entirely at the cost of file-transfer availability.