Live › vulnerability › CVE-2026-91527
Go to dashboardOracle ZFS Storage Appliance Kit 8.8 has a flaw in the Core component reachable over HTTP. Any low-privileged authenticated user on the network can take over the appliance (CVSS 3.1 8.8, AV:N/AC:L/PR:L). Fixed in the October 2026 Critical Patch Update. Oracle shipped ZFSSA AK OS8.8.96 on 21 Oct, which is probably the fixed build but is not confirmed for this CVE. No exploitation or public PoC reported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Oracle ZFS Storage Appliance Kit | vendor | 8.8 (builds before the October 2026 CPU fix) | unknown - likely OS8.8.96, unconfirmed |
maintenance system updates show / configuration version showEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in takeover of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-91527")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.