{"id":"CVE-2026-91527","kind":"vulnerability","aliases":["CVE-2026-91527"],"related":[],"title":"Oracle ZFS Storage Appliance Kit: low-privilege network user can take over appliance","description":"Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).   The supported version that is affected is 8.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.  Successful attacks of this vulnerability can result in takeover of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle ZFS Storage Appliance Kit 8.8 has a flaw in the Core component reachable over HTTP. Any low-privileged authenticated user on the network can take over the appliance (CVSS 3.1 8.8, AV:N/AC:L/PR:L). Fixed in the October 2026 Critical Patch Update. Oracle shipped ZFSSA AK OS8.8.96 on 21 Oct, which is probably the fixed build but is not confirmed for this CVE. No exploitation or public PoC reported.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle ZFS Storage Appliance Kit","fixed":["unknown - likely OS8.8.96, unconfirmed"],"affected":"8.8 (builds before the October 2026 CPU fix)","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","oracle-zfs-storage-appliance","oracle-zfs-storage-appliance-kit","self-hosted","storage"],"not_affected_if":["not-os8.8"],"how_to_check":"On the appliance, check the running software version: BUI under Maintenance > System, or CLI 'maintenance system updates show' / 'configuration version show'. Any 8.8 build older than OS8.8.96 (2026.4 Update 8.96) should be treated as exposed until the MOS patch notes confirm the fixed build. Also check who can reach the management HTTP/HTTPS interface and which low-privilege accounts exist.","fix":"Apply the October 2026 CPU patch for ZFS Storage Appliance via My Oracle Support. Likely target: ZFSSA AK OS8.8.96 (2026.4 Update 8.96, ARU 29487246); confirm in its release notes that CVE-2026-91527 is listed. Until patched, limit management interface access to trusted admin networks and audit low-privilege accounts.","status":"open","published_at":"2026-10-20T22:20:56+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:54+00:00","updated_at":"2026-10-23T23:53:28+00:00","category":"infrastructure","confidence":0.55,"triage":{"at":"2026-10-23T22:33:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle ZFS Storage Appliance Kit: low-privilege network user can take over appliance","impact":"high","summary":"Oracle ZFS Storage Appliance Kit (version 8.8 is listed as affected) has a flaw in its Core component that can be reached over HTTP. A low-privileged attacker on the network can take over the appliance, with full impact to confidentiality, integrity and availability.","category":"infrastructure","who_cares":["oracle-zfs-storage-appliance","self-hosted","storage"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over the storage appliance over HTTP with a low-privilege account.","analyst_note":"Find the Oracle Critical Patch Update or security alert that lists the fixed ZFS Storage Appliance Kit release and the exposure check; the sources give only the NVD entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00088,"input_tokens":3083,"output_tokens":1143,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update or security alert that lists the fixed ZFS Storage Appliance Kit release and the exposure check; the sources give only the NVD entry.","search":"'-2026':16A,19A '-91527':17A,20A '/av':184C '2026':83B '21':93B '3.1':73B,171C,183C '8.8':47B,74B,135C,174C 'access':145C 'affect':133C 'ak':90B 'allow':139C 'applianc':4A,14A,31B,36B,45B,71B,120C,153C,168C 'appliance':24A 'attack':142C,156C 'authent':62B 'av':75B 'avail':178C 'base':172C 'build':100B 'compon':54B,126C 'compromis':149C 'confidenti':175C 'confirm':104B 'core':53B,127C 'critic':84B 'cve':15A,18A,107B 'cvss':72B,170C,180C,182C 'easili':136C 'exploit':109B,137C 'fix':79B,99B 'flaw':50B 'h':192C 'h/a':191C 'h/i':190C 'host':40B 'http':57B,147C 'impact':179C 'infrastructur':26B 'integr':176C 'kit':5A,25A,37B,46B,121C,154C,169C 'l':78B 'l/pr':77B,186C 'l/ui':187C 'low':7A,60B,140C 'low-privileg':6A,59B 'n/ac':76B,185C 'n/s':188C 'network':9A,66B,144C 'oct':94B 'octob':82B 'oracl':1A,28B,33B,42B,87B,117C,124C,150C,165C 'oracle':21A 'oracle-zfs-storage-appli':27B 'oracle-zfs-storage-appliance-kit':32B 'os8.8.96':91B 'patch':85B 'poc':112B 'privileg':8A,61B,141C 'probabl':97B 'product':122C 'public':111B 'reachabl':55B 'report':113B 'result':161C 'score':173C 'self':39B 'self-host':38B 'ship':88B 'storag':3A,30B,35B,41B,44B,119C,152C,167C 'storage':23A 'success':155C 'support':129C 'system':125C 'take':12A,68B 'takeov':163C 'u/c':189C 'updat':86B 'user':10A,63B 'vector':181C 'version':130C 'via':146C 'vulner':114C,138C,159C 'zfs':2A,22A,29B,34B,43B,118C,151C,166C 'zfssa':89B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91527","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91527","severity":null,"published_at":"2026-10-20T22:20:56+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91527:539","url":null,"severity":null,"published_at":"2026-10-23T23:53:28+00:00","modified_at":"2026-10-23T23:53:28+00:00","first_seen_at":"2026-10-23T23:53:28+00:00","fetched_at":"2026-10-23T23:53:28+00:00","note":"Oracle CPU Oct 2026 (20 Oct) is the advisory; CVE record confirms only 8.8 affected, CVSS 8.8. The CPU page text I could read was truncated before the Systems matrix, so the exact fixed build is not confirmed. Oracle announced ZFSSA AK OS8.8.96 on 21 Oct (ARU 29487246), the likely vehicle, but the post does not name this CVE. Patch docs sit behind My Oracle Support. No X chatter, no KEV, no PoC found. Sibling: CVE-2026-101597, same component, medium."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2222,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91527","title":"CVE Record: CVE-2026-91527 (Oracle CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2221,"url":"https://community.oracle.com/mosc/discussion/4601671/announce-os8-8-96-is-available-on-mos","title":"ANNOUNCE: OS8.8.96 is Available on MOS (ZFSSA AK 2026.4 Update 8.96)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}