{"id":"CVE-2026-101597","kind":"vulnerability","aliases":["CVE-2026-101597"],"related":[],"title":"Oracle ZFS Storage Appliance Kit: unauthenticated network flaw leaks a subset of data","description":"Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).   The supported version that is affected is 8.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle ZFS Storage Appliance Kit accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle ZFS Storage Appliance Kit 8.8 has a flaw in its Core component that can be reached over HTTP without logging in. An attacker can read a subset of the data the appliance holds, but cannot change it or take control of the system.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","oracle","self-hosted","storage","zfs-storage-appliance"],"not_affected_if":["different-version","no-network-exposure"],"how_to_check":"- Confirm whether the appliance runs Oracle ZFS Storage Appliance Kit `8.8` by checking the installed software version in the appliance management interface\n- unknown for other checks, the sources do not say","fix":"- Apply the patch Oracle publishes for Oracle ZFS Storage Appliance Kit `8.8` (the sources do not name a fixed build)\n- Restrict HTTP access to the appliance management interface to trusted networks until patched","status":"open","published_at":"2026-10-20T22:18:13+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:23:13+00:00","updated_at":"2026-10-25T04:23:13+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:23:13Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the patch Oracle publishes for Oracle ZFS Storage Appliance Kit `8.8` (the sources do not name a fixed build)\n- Restrict HTTP access to the appliance management interface to trusted networks until patched","reach":"network","title":"Oracle ZFS Storage Appliance Kit: unauthenticated network flaw leaks a subset of data","impact":"low","summary":"Oracle ZFS Storage Appliance Kit 8.8 has a flaw in its Core component that can be reached over HTTP without logging in. An attacker can read a subset of the data the appliance holds, but cannot change it or take control of the system.","category":"infrastructure","nicknames":[],"who_cares":["oracle","zfs-storage-appliance","storage","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads a subset of appliance data without logging in","analyst_note":"Check Oracle's Critical Patch Update advisory for CVE-2026-101597 to confirm the fixed build and the exact exposed data set.","how_to_check":"- Confirm whether the appliance runs Oracle ZFS Storage Appliance Kit `8.8` by checking the installed software version in the appliance management interface\n- unknown for other checks, the sources do not say","needs_analyst":true,"not_affected_if":["different-version","no-network-exposure"],"who_is_affected":"Sites that run Oracle ZFS Storage Appliance Kit version 8.8 and expose its HTTP interface to a network the attacker can reach. The sources do not say whether default configurations are exposed, so treat any reachable appliance as in scope. Sites on other versions or with the HTTP interface limited to trusted hosts are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":3468,"output_tokens":641,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101597':16A,19A '-2026':15A,18A '/av':147C '3.1':137C,146C '5.3':140C '8.8':35B,95C 'access':104C,124C,134C 'affect':93C 'allow':99C 'applianc':4A,29B,33B,62B,80C,112C,132C 'attack':53B,101C,115C 'base':138C 'cannot':65B 'chang':66B 'compon':42B,86C 'compromis':108C 'confidenti':141C 'control':70B 'core':41B,87C 'cve':14A,17A 'cvss':136C,143C,145C 'data':13A,60B,135C 'easili':96C 'exploit':97C 'flaw':8A,38B 'hold':63B 'host':24B 'http':48B,106C 'impact':142C 'infrastructur':20B 'kit':5A,34B,81C,113C,133C 'l/i':153C 'l/pr':149C 'leak':9A 'log':50B 'n':155C 'n/a':154C 'n/ac':148C 'n/s':151C 'n/ui':150C 'network':7A,103C 'oracl':1A,21B,30B,77C,84C,109C,129C 'product':82C 'reach':46B 'read':55B,123C 'result':120C 'score':139C 'self':23B 'self-host':22B 'storag':3A,25B,28B,32B,79C,111C,131C 'subset':11A,57B,127C 'success':114C 'support':89C 'system':73B,85C 'take':69B 'u/c':152C 'unauthent':6A,100C 'unauthor':122C 'vector':144C 'version':90C 'via':105C 'vulner':74C,98C,118C 'without':49B 'zfs':2A,27B,31B,78C,110C,130C 'zfs-storage-appli':26B","nicknames":[],"mitigations":[],"who_affected":"Sites that run Oracle ZFS Storage Appliance Kit version 8.8 and expose its HTTP interface to a network the attacker can reach. The sources do not say whether default configurations are exposed, so treat any reachable appliance as in scope. Sites on other versions or with the HTTP interface limited to trusted hosts are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101597","severity":null,"published_at":"2026-10-20T22:18:13+00:00","modified_at":"2026-10-21T18:43:53+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}