---
id: "CVE-2026-91527"
kind: "vulnerability"
aliases: ["CVE-2026-91527"]
title: "Oracle ZFS Storage Appliance Kit: low-privilege network user can take over appliance"
severity: "high"
cvss: 8.8
epss: 0.00447
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Oracle ZFS Storage Appliance Kit", "fixed": ["unknown - likely OS8.8.96, unconfirmed"], "affected": "8.8 (builds before the October 2026 CPU fix)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "oracle-zfs-storage-appliance", "oracle-zfs-storage-appliance-kit", "self-hosted", "storage"]
not_affected_if: ["not-os8.8"]
published_at: "2026-10-20T22:20:56+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91527", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:53:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91527", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle ZFS Storage Appliance Kit: low-privilege network user can take over appliance

Oracle ZFS Storage Appliance Kit 8.8 has a flaw in the Core component reachable over HTTP. Any low-privileged authenticated user on the network can take over the appliance (CVSS 3.1 8.8, AV:N/AC:L/PR:L). Fixed in the October 2026 Critical Patch Update. Oracle shipped ZFSSA AK OS8.8.96 on 21 Oct, which is probably the fixed build but is not confirmed for this CVE. No exploitation or public PoC reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle ZFS Storage Appliance Kit affected 8.8 (builds before the October 2026 CPU fix) fixed unknown - likely OS8.8.96, unconfirmed

## How to check

On the appliance, check the running software version: BUI under Maintenance > System, or CLI 'maintenance system updates show' / 'configuration version show'. Any 8.8 build older than OS8.8.96 (2026.4 Update 8.96) should be treated as exposed until the MOS patch notes confirm the fixed build. Also check who can reach the management HTTP/HTTPS interface and which low-privilege accounts exist.

## Fix

Apply the October 2026 CPU patch for ZFS Storage Appliance via My Oracle Support. Likely target: ZFSSA AK OS8.8.96 (2026.4 Update 8.96, ARU 29487246); confirm in its release notes that CVE-2026-91527 is listed. Until patched, limit management interface access to trusted admin networks and audit low-privilege accounts.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91527
- 2026-10-23T23:53:28+00:00 analyst — Oracle CPU Oct 2026 (20 Oct) is the advisory; CVE record confirms only 8.8 affected, CVSS 8.8. The CPU page text I could read was truncated before the Systems matrix, so the exact fixed build is not confirmed. Oracle announced ZFSSA AK OS8.8.96 on 21 Oct (ARU 29487246), the likely vehicle, but the post does not name this CVE. Patch docs sit behind My Oracle Support. No X chatter, no KEV, no PoC found. Sibling: CVE-2026-101597, same component, medium.
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91527

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91527 (Oracle CNA) https://www.cve.org/CVERecord?id=CVE-2026-91527
- [fix] ANNOUNCE: OS8.8.96 is Available on MOS (ZFSSA AK 2026.4 Update 8.96) https://community.oracle.com/mosc/discussion/4601671/announce-os8-8-96-is-available-on-mos

## From the sources

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).   The supported version that is affected is 8.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.  Successful attacks of this vulnerability can result in takeover of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_