EUVD-2026-106005
GHSA-59fc-wjpg-jg5q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach appliance HTTP interface
-
ExploitSend crafted unauthenticated request
-
ExecutionAccess control bypassed
-
ImpactRead subset of appliance data
Vulnerability Assessment
| Exploitation Conditions | No special conditions stated - remote unauthenticated exploitation over HTTP against the Oracle ZFS Storage Appliance Kit 8.8 (Core) HTTP interface, per AV:N/AC:L/PR:N/UI:N. Limiting factors: impact is confined to unauthorized READ access to only a SUBSET of appliance-accessible data (C:L; no integrity or availability impact), and practical exploitation requires network reachability to the appliance's HTTP service/management interface, so appliances restricted to an isolated management network are substantially less exposed. Only version 8.8 is listed as affected. |
| Impact | This is a moderate-severity information-disclosure issue (CVSS 3.1 5.3) rather than a top-tier priority. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates an easily exploitable, remote, unauthenticated attack over HTTP, which raises exposure, but the impact is strictly limited to unauthorized read access to a SUBSET of data (C:L, I:N, A:N) - no write, code execution, or availability impact. Oracle supplied no EPSS score, the CVE is not listed in CISA KEV, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data provided. The one notable conflict is the 'Authentication Bypass' tag versus the description/CVSS, which describe unauthenticated read access to a limited data subset (classic information disclosure) and not a full authentication-bypass that would grant broader control - treat the tag with caution and verify against Oracle's CPU advisory. Net: easy-to-reach but low-impact; patch on a normal Oracle quarterly-CPU cadence rather than emergency timeline unless the appliance is internet-exposed. |
| Exploit ScenarioDerived | An attacker with network reachability to the ZFS Storage Appliance's HTTP management/service interface sends a crafted unauthenticated HTTP request and retrieves a subset of appliance-accessible data without credentials or user interaction. No public exploit code is referenced, and the leak is partial read-only rather than full compromise. Risk rises sharply if the appliance's HTTP interface is exposed beyond a trusted management network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated HTTP access to Oracle ZFS Storage Appliance Kit 8.8 can expose a subset of appliance-accessible data, giving remote attackers a limited confidentiality-only impact rated CVSS 3.1 5.3. The flaw is network-reachable with low attack complexity and no privileges or user interaction required, but it does not affect integrity or availability, and only version 8.8 is listed as affected. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was provided; exploitation depends on reaching the appliance's HTTP management interface, so appliances confined to an isolated management network are materially less exposed.
RemediationAI
Patch available per vendor advisory: apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which addresses ZFS Storage Appliance Kit 8.8; the supplied data does not specify a minimum patched build, so confirm the exact fixed version in My Oracle Support before upgrading. Until patched, restrict the appliance's HTTP management and REST interfaces to a dedicated management VLAN or an allowlist of administrative hosts, and block them at the perimeter; the trade-off is loss of remote administrative convenience and the need for jump hosts or VPN access. Disable unused HTTP endpoints and nonessential REST services, accepting that some monitoring integrations may stop working. Add logging and alerting for anomalous unauthenticated read requests against management URLs, understanding that this is detective rather than preventive. Because the issue is confidentiality-only and requires network reachability, network segmentation provides the strongest compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle ZFS Storage Appliance Kit is the management and control software for Oracle's ZFS-based storage appliances, exposing administrative and monitoring functionality over HTTP, including browser-based and REST-style interfaces. The affected component is listed as "Core," and Oracle's advisory does not publish a CWE or detailed root-cause description, so the precise defect is not disclosed. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is consistent with an access-control or information-exposure weakness in an HTTP-exposed endpoint that permits unauthenticated retrieval of a limited subset of data, rather than a memory-corruption or command-execution flaw. No CPE strings were supplied; affected-version identification therefore rests on the EUVD and Oracle CPU entries, which name only ZFS Storage Appliance Kit 8.8.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated HTTP access (AV:N/AC:L/PR:N/UI:N) yielding partial read of a data subset (C:L) with no integrity or availability impact (I:N/A:N).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle ZFS Storage Appliance Kit accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB