Oracle ZFS Storage Appliance Kit: Remote compromise via HTTP in Core component
Summary
A vulnerability in the Core component of Oracle ZFS Storage Appliance Kit version 8.8 allows an attacker with low privileges and network access via HTTP to compromise the appliance. Successful exploitation can lead to a full takeover with high impact on confidentiality, integrity and availability. No user interaction is required, and no public proof-of-concept or active exploitation has been reported so far.
Affected
- Oracle ZFS Storage Appliance Kit, version 8.8 only
- Component: Core
Fixed in
- Unknown. Check the patch availability section of Oracle's October 2026 Critical Patch Update advisory for the fixed patch.
Workaround
- Unknown. Oracle's advisory did not list a workaround in the available sources.
- General measure: restrict network access to the management interface to authorized administrators only.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Not listed in CISA KEV.
- No public proof-of-concept found in the research. This does not prove that none exists.
- EPSS: 0.00447.
Our recommendation
- Check whether an Oracle ZFS Storage Appliance with Kit version 8.8 is in use.
- Obtain the fixed patch from Oracle's advisory and apply it as soon as possible, together with CVE-2026-101597.
- Until patched, restrict access to the management interface to trusted networks and authorized users, and review accounts with low privileges.
- Monitor logs for unusual HTTP access to the management interface.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- CISA SSVC data via OpenCVE app.opencve.io
- Vulners: CVE-2026-91527 vulners.com
- Strix: CVE-2026-91527 www.strix.ai
- Strix: CVE-2026-101597 (related issue) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:25.
Original description (NVD)
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in takeover of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.