Live › vulnerability › CVE-2026-101597
Go to dashboardOracle ZFS Storage Appliance Kit 8.8 has a flaw in its Core component that can be reached over HTTP without logging in. An attacker can read a subset of the data the appliance holds, but cannot change it or take control of the system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites that run Oracle ZFS Storage Appliance Kit version 8.8 and expose its HTTP interface to a network the attacker can reach. The sources do not say whether default configurations are exposed, so treat any reachable appliance as in scope. Sites on other versions or with the HTTP interface limited to trusted hosts are less exposed.
No product ranges from the sources yet.
8.8 by checking the installed software version in the appliance management interface8.8 (the sources do not name a fixed build)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle ZFS Storage Appliance Kit accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101597")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.