CVE-2026-101597
MediumCVSS 5.3Summary
Vulnerability in Oracle ZFS Storage Appliance Kit (Core component) affects version 8.8. An easily exploitable network attack by an unauthenticated attacker can result in unauthorized read access to a subset of data.
Risk Assessment
An unauthenticated attacker with network access can read a subset of appliance data. Impact on confidentiality (CVSS 5.3).
Recommendation
Apply Oracle's fix for ZFS Storage Appliance Kit. Restrict network access to the HTTP interface and monitor data access.
Other vulnerabilities in Oracle ZFS Storage Appliance Kit
See all- CVE-2026-91527High
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core), affecting version 8.8. An easily exploitable flaw allows a low-privileged attacker with HTTP network access to take over Oracle ZFS Storage Appliance Kit.
- CVE-2025-62480Low
Vulnerability in the Oracle ZFS Storage Appliance Kit product (component: Naming Subsystem). The supported version affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit, resulting in unauthorized ability to cause a partial denial of service. CVSS 3.1 Base Score 2.7 (Availability impacts).
- CVE-2025-62479Low
Vulnerability in Oracle ZFS Storage Appliance Kit (component: Block Storage). Affected version is 8.8. A high privileged attacker with network access via HTTP can compromise the appliance, resulting in partial denial of service. CVSS 3.1 Base Score 2.7 (Availability impacts).
- CVE-2025-62478Medium
Oracle ZFS Storage Appliance Kit version 8.8 contains a vulnerability in the Object Store component. A high privileged attacker with network access via HTTP can exploit it to cause a hang or frequently repeatable crash (complete DOS). CVSS 4.9 (Availability impact).
- CVE-2025-62477Medium
Oracle ZFS Storage Appliance Kit version 8.8 contains a vulnerability in the Remote Replication component. A high privileged attacker with network access via HTTP can exploit it to cause a hang or frequently repeatable crash (complete DOS). CVSS 4.9 (Availability impact).
- CVE-2025-62476Medium
Vulnerability in Oracle ZFS Storage Appliance Kit (component: Remote Replication) affecting version 8.8. A high-privileged attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS) of the appliance.
- CVE-2025-62475Medium
Oracle ZFS Storage Appliance Kit version 8.8 contains a vulnerability in the Core component. A high privileged attacker with network access via HTTP can exploit it to cause a hang or frequently repeatable crash (complete DOS). CVSS 4.9 (Availability impact).
- CVE-2025-62290High
Vulnerability in Oracle ZFS Storage Appliance Kit (Block Storage component) version 8.8. A high privileged attacker with network access via HTTP can compromise the appliance, potentially leading to full takeover. CVSS 7.2.
- CVE-2025-62289Medium
Vulnerability in Oracle ZFS Storage Appliance Kit version 8.8, in the Filesystems component. A high privileged attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS) of the appliance. CVSS 4.9 (Availability impact).
- CVE-2025-53046Medium
Vulnerability in Oracle ZFS Storage Appliance Kit (Analytics component) version 8.8. A high-privileged attacker with network access via HTTP can remotely cause a hang or frequently repeatable crash (complete DOS) of the appliance. CVSS 3.1 Base Score 4.9 (Availability impacts).
Original NVD description (English source)
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle ZFS Storage Appliance Kit accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS