Fujitsu openFT CVE-2026-16607

Exploitation requires the attacker to already be an authenticated local user (PR:L) on a GNU/Linux or Oracle Solaris host running Fujitsu openFT before version 12.1D00; the description explicitly frames this as 'local privilege escalation to root of an already authenticated user.' The vector is local only (AV:L) with no remote or network path, and no user interaction is needed. Limiting factors that reduce realistic risk: the requirement for a pre-existing valid local account, the local-only attack surface (not remotely reachable), and the restricted deployment footprint of openFT (mainframe/managed-file-transfer environments); the presence of the vulnerable openFT product on the host is itself a prerequisite.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a local-only attack requiring an existing authenticated foothold with low privileges, no user interaction, and low complexity, yielding full compromise of confidentiality, integrity, and availability on the target system - consistent with root takeover. This is a genuine, high-impact escalation primitive but not an internet-facing mass-exploitation risk: an attacker must already have a valid local account, which caps blast radius to multi-user hosts, shared servers, and post-initial-access scenarios. There is no CISA KEV listing and no public POC, so the signal is 'no public exploit identified at time of analysis' - the 8.5 score reflects impact severity, not demonstrated ease of remote exploitation. No EPSS value was provided in the input, so probabilistic exploitation likelihood cannot be quantified here; given the niche deployment footprint and local-access requirement, real-world urgency is moderate and driven by environments where openFT runs on shared/multi-user systems.

An attacker who already holds a low-privileged but authenticated local account on a Linux or Solaris server running a vulnerable openFT (before 12.1D00) - for example, a legitimate operator, a compromised service account, or an intruder who gained an initial foothold via another vector - abuses openFT's privileged component to elevate to root. With low attack complexity and no user interaction required, this converts limited local access into full system control. No public POC is currently identified, so exploitation would require the attacker to independently develop the escalation.