> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Oracle Solaris and ZFS flaws allow remote code execution and data breach - URL: https://f4n6.co.uk/security-feed/oracle-solaris-and-zfs-flaws-allow-remote-code-execution-and-data-breach/ - Published: 2026-10-26T18:35:51.000Z - Updated: 2026-10-26T18:35:51.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-101537, CVE-2026-101597, CVE-2026-47025, CVE-2026-60432, CVE-2026-60453 ## 1\. Executive summary Oracle published its October 2026 Critical Patch Update (cpuoct2026) on 20 October 2026, and CERT-FR issued advisory CERTFR-2026-AVI-1353 the following day covering the Oracle Systems subset: Oracle Solaris 11.3, Oracle Solaris 11.4 and Oracle ZFS Storage Appliance Kit 8.8\. CERT-FR lists remote arbitrary code execution, remote denial of service, data confidentiality and integrity impact, and security-policy bypass among the possible outcomes. Two flaws carry CVSS 9.8 CRITICAL, CVE-2026-101537 and CVE-2026-60432, both classified CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function), which points at authentication bypass on a network-reachable component. None of the ten CVEs with verified scoring is in CISA KEV and all sit at EPSS 0%, so there is no evidence of exploitation in the wild at the time of writing. The exposure for EMEA financial services is concentrated in Solaris estates running core banking, market-data or settlement platforms, and in ZFS Storage Appliance arrays holding backup and archive data, where an unauthenticated network flaw on a storage control plane is a direct path to bulk data access. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | -------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk, general principles | The fixes exist only in Oracle's cpuoct2026 bulletin, and CERT-FR directs affected parties to the vendor bulletin rather than supplying its own remediation. Solaris and ZFS appliances are typically delivered and supported under an Oracle support contract. | Clients must confirm the Oracle support entitlement covers the affected Solaris 11.3/11.4 and ZFS 8.8 systems, track the cpuoct2026 fix status through the third-party register, and record the patch position as a contractual deliverable rather than an internal task. | | DORA Art. 24: digital operational resilience testing, general requirements | Two CVSS 9.8 authentication-bypass flaws (CWE-287/CWE-306) on network-reachable Solaris and ZFS components create a testable attack path that existing resilience testing may not cover. | Add authenticated and unauthenticated access tests against the Solaris and ZFS management interfaces to the testing programme, and record the result against the cpuoct2026 baseline. | ## 3\. Technical analysis & attack chain CERT-FR gives no exploitation detail, no attack vector strings and no proof-of-concept. What follows is limited to what the advisory and the CVE records establish, and the gaps are stated rather than filled. The affected products are Oracle Solaris 11.3, Oracle Solaris 11.4 and Oracle ZFS Storage Appliance Kit 8.8\. CERT-FR attributes five risk classes to the set: remote arbitrary code execution, remote denial of service, breach of data confidentiality, breach of data integrity, and security-policy bypass. It does not map individual CVEs to individual risk classes, so which flaw produces which outcome is not established by the source. The two critical entries are the operationally significant ones. CVE-2026-101537 and CVE-2026-60432 are both CVSS 9.8 and both carry CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function). CWE-306 means a critical function can be reached without authentication at all; CWE-287 means authentication is present but can be bypassed. Either classification, applied to a network-reachable Solaris service or a ZFS appliance management interface, gives an unauthenticated attacker the pre-condition for the code execution and data exposure CERT-FR describes. The verified data does not state which component hosts the vulnerable function, which port or protocol is involved, or whether exploitation requires network position inside the management VLAN. Those specifics are not in the source and should be taken from the Oracle cpuoct2026 bulletin before scoping exposure. The remaining scored flaws are lower impact but relevant to availability and confidentiality. CVE-2026-47025 is CVSS 8.8 HIGH. CVE-2026-60662 is CVSS 7.8 HIGH. CVE-2026-87417 is CVSS 7.5 HIGH and classified CWE-200 (Exposure of Sensitive Information), which on a storage appliance is the confidentiality path. CVE-2026-87411 and CVE-2026-87413 are CVSS 5.5 MEDIUM, both CWE-400 (Uncontrolled Resource Consumption), the denial-of-service path. CVE-2026-87414 is CVSS 3.1 LOW, CWE-345 (Insufficient Verification of Data Authenticity), which bears on the integrity risk CERT-FR lists. CVE-2026-101597 and CVE-2026-60453 are CVSS 5.3 MEDIUM with no CWE recorded in the verified data. A confirmed step-by-step attack chain cannot be written from these sources. CERT-FR provides no initial-access vector, no payload, no persistence mechanism, no command-and-control detail and no observed post-exploitation activity, and no exploitation has been reported. The chain is therefore stated only at the level the data supports: 1. An attacker reaches the vulnerable Solaris or ZFS component over the network. The transport, port and required network position are not stated in the source. 2. For CVE-2026-101537 or CVE-2026-60432, authentication is bypassed or absent (CWE-287/CWE-306), giving access to a critical function without valid credentials. 3. From that position the attacker can achieve remote code execution, remote denial of service, or access to and modification of data, per CERT-FR's risk list. Which flaw yields which outcome is not mapped in the source. Two discrepancies are worth recording. CERT-FR's CVE list for this advisory names 29 identifiers, but only ten carry verified scoring; the remaining 19 (including CVE-2026-87421, CVE-2026-87422, CVE-2026-87423, the CVE-2026-912xx series and CVE-2026-91527/CVE-2026-91537) have no CVSS, CWE or exploitation state in the verified data and are not assessed here. Separately, the same cpuoct2026 cycle produced CERT-FR advisories for Oracle MySQL (CERTFR-2026-AVI-1351) and Oracle Database Server (CERTFR-2026-AVI-1349); those are different product sets with different CVE lists and are out of scope for this note, but a client running Solaris alongside Oracle Database or MySQL should treat the October cycle as one patch event across all three. No threat actor is named in any source and no MITRE ATT&CK profile applies. There is no attribution to make. ## 4\. Mitigation & containment ### P1 within 24h - Inventory every Solaris 11.3 and 11.4 host and every ZFS Storage Appliance at Kit 8.8\. Confirm which are reachable from anything other than a restricted management network. - Apply the Oracle cpuoct2026 fixes to internet-facing or broadly reachable Solaris and ZFS systems first, prioritising any host exposing an authentication-bearing service to a lower-trust zone. CERT-FR directs clients to the Oracle bulletin at https://www.oracle.com/security-alerts/cpuoct2026.html for the patches; the bulletin is the authoritative source for which fix addresses which CVE. - Where patching cannot be completed inside 24h, restrict network access to the Solaris and ZFS management interfaces to named administrative hosts, and log all access attempts to those interfaces. ### P2 within 72h - Patch the remaining Solaris 11.3/11.4 and ZFS 8.8 estate from cpuoct2026\. Solaris 11.3 is an older release line; confirm with Oracle support that a cpuoct2026 fix exists for it before assuming the 11.4 patch applies. - For the CWE-400 denial-of-service flaws (CVE-2026-87411, CVE-2026-87413), confirm rate-limiting or connection limits on the exposed services as an interim control until the patch is applied. - For CVE-2026-87417 (CWE-200, sensitive information exposure), review what data the affected component can return to an unauthenticated or low-privilege caller and whether that data includes customer, cardholder or transaction records. ### P3 within 7 days - Add the Solaris and ZFS management interfaces to authenticated and unauthenticated access testing under the DORA Art. 24 testing programme, and record the cpuoct2026 baseline as the pass condition. - Update the third-party register entry for Oracle to reflect the cpuoct2026 patch position across Solaris and ZFS, per DORA Art. 28. - Review ZFS Storage Appliance backup and archive data for classification, so that a confidentiality breach on the array can be scoped quickly if one occurs. ## 5\. Indicators of compromise No indicators of compromise available in the source material. CERT-FR publishes no hashes, network indicators, file paths or behavioural telemetry for this advisory, and no exploitation has been reported. Detection must rest on patch-state and access-log monitoring rather than atomic indicators. ## 6\. Detection Insufficient indicators to author detection rules. The sources contain no distinctive strings, command-line flags, file paths, registry keys or behavioural artefacts specific to these vulnerabilities. CERT-FR names the affected product versions and CVE identifiers only; a rule built on those would detect reporting about the flaw, not exploitation of it. Until the Oracle cpuoct2026 bulletin or a vendor or incident report supplies concrete artefacts, detection should focus on unauthorised access attempts to Solaris and ZFS management interfaces and on patch-compliance monitoring against the cpuoct2026 baseline. ## CVE assessment 10 referenced CVEs — 2 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | --------- | ---- | ------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-101537](https://nvd.nist.gov/vuln/detail/CVE-2026-101537?ref=f4n6.co.uk) | 9.8 Critical | — | 0% | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is… | | [CVE-2026-60432](https://nvd.nist.gov/vuln/detail/CVE-2026-60432?ref=f4n6.co.uk) | 9.8 Critical | — | 0% | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). Supported versions that are… | | [CVE-2026-47025](https://nvd.nist.gov/vuln/detail/CVE-2026-47025?ref=f4n6.co.uk) | 8.8 High | — | 0% | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 1… | | [CVE-2026-60662](https://nvd.nist.gov/vuln/detail/CVE-2026-60662?ref=f4n6.co.uk) | 7.8 High | — | 0% | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected i… | | [CVE-2026-87417](https://nvd.nist.gov/vuln/detail/CVE-2026-87417?ref=f4n6.co.uk) | 7.5 High | — | 0% | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). The supported version that… | | [CVE-2026-87411](https://nvd.nist.gov/vuln/detail/CVE-2026-87411?ref=f4n6.co.uk) | 5.5 Medium | — | 0% | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is affecte… | | [CVE-2026-87413](https://nvd.nist.gov/vuln/detail/CVE-2026-87413?ref=f4n6.co.uk) | 5.5 Medium | — | 0% | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is affecte… | | [CVE-2026-101597](https://nvd.nist.gov/vuln/detail/CVE-2026-101597?ref=f4n6.co.uk) | 5.3 Medium | — | 0% | Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that… | | [CVE-2026-60453](https://nvd.nist.gov/vuln/detail/CVE-2026-60453?ref=f4n6.co.uk) | 5.3 Medium | — | 0% | Vulnerability in the Oracle Solaris product of Oracle Systems (component: X Window System). The supported version that is aff… | | [CVE-2026-87414](https://nvd.nist.gov/vuln/detail/CVE-2026-87414?ref=f4n6.co.uk) | 3.1 Low | — | 0% | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). The supported version that… | ## 7\. Sources - ANSSI / CERT-FR, "Multiples vulnérabilités dans Oracle Systems" (CERTFR-2026-AVI-1353), 21 October 2026\. https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1353/ - Oracle, Critical Patch Update cpuoct2026, 20 October 2026\. https://www.oracle.com/security-alerts/cpuoct2026.html - ANSSI / CERT-FR, "Multiples vulnérabilités dans Oracle MySQL" (CERTFR-2026-AVI-1351), 21 October 2026\. https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1351/ - ANSSI / CERT-FR, "Multiples vulnérabilités dans Oracle Database Server" (CERTFR-2026-AVI-1349), 21 October 2026\. https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1349/ ## 8\. Adverse Trace position Adverse Trace assesses this as a high-priority patch item rather than an active incident. The two CVSS 9.8 authentication-bypass flaws on network-reachable Solaris and ZFS components are the reason: unauthenticated access to a critical function on a storage control plane or a core-banking Solaris host is a direct route to the data confidentiality and integrity impact CERT-FR describes. The absence of any CISA KEV entry and the 0% EPSS across all ten scored CVEs means there is no evidence of exploitation, and we are not raising this above a scheduled emergency-patch posture on that basis. The scoring and exploitation states here are drawn from NVD, EPSS and CISA KEV; the technical description rests on a single source, CERT-FR, which gives no exploitation detail, so the mechanism and attack path should be confirmed against the Oracle cpuoct2026 bulletin before any client treats the CWE-306 reading as definitive. We will pull the per-CVE fix mapping from the Oracle bulletin, re-check EPSS and KEV status over the next 14 days, and issue an update if either critical CVE shows exploitation or a public proof-of-concept appears. Clients running Solaris 11.3/11.4 or ZFS 8.8 in payment, settlement or market-data paths should treat the P1 actions in section 4 as due now. --- [Read the original source →](https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1353/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*