---
id: "CVE-2026-101597"
kind: "vulnerability"
aliases: ["CVE-2026-101597"]
title: "Oracle ZFS Storage Appliance Kit: unauthenticated network flaw leaks a subset of data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "oracle", "self-hosted", "storage", "zfs-storage-appliance"]
not_affected_if: ["different-version", "no-network-exposure"]
published_at: "2026-10-20T22:18:13+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T04:23:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101597", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle ZFS Storage Appliance Kit: unauthenticated network flaw leaks a subset of data

Oracle ZFS Storage Appliance Kit 8.8 has a flaw in its Core component that can be reached over HTTP without logging in. An attacker can read a subset of the data the appliance holds, but cannot change it or take control of the system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the appliance runs Oracle ZFS Storage Appliance Kit `8.8` by checking the installed software version in the appliance management interface
- unknown for other checks, the sources do not say

## Fix

- Apply the patch Oracle publishes for Oracle ZFS Storage Appliance Kit `8.8` (the sources do not name a fixed build)
- Restrict HTTP access to the appliance management interface to trusted networks until patched

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101597

## From the sources

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).   The supported version that is affected is 8.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle ZFS Storage Appliance Kit accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_