Oracle ZFS Storage Appliance Kit: low-privileged HTTP request takes over the storage controller

Impact

Oracle rates this an easily exploitable takeover of the appliance by an attacker with network HTTP access and low privileges, with high confidentiality, integrity and availability impact. A ZFS appliance head is usually the shared NFS/iSCSI backing for dataset and checkpoint storage, so control of it means reading or tampering with every tenant's training data and models, and the ability to stall every GPU job that has a mount outstanding. Loss of the head is not a per-node failure that drains cheaply - NFS clients hang rather than fail, and jobs across the fleet wedge together. Oracle's CPU text does not disclose the mechanism.

Who can reach it

Anyone who can reach the appliance management HTTP service with a low-privileged account - typically the management VLAN. Authentication is required but no administrator role is.

What to do

Apply the fixes in Oracle's October 2026 Critical Patch Update to ZFS Storage Appliance Kit 8.8. Oracle publishes no mitigation for this one, so the only answer is the appliance software update; plan it as a maintenance window with a cluster takeover (or a storage outage on a single-head appliance) and expect client mounts to stall during failover. In the meantime restrict the appliance management interface to the management network and review which accounts can authenticate to it. The CPU advisory gives no further detail on the affected component.

References

Related entries

• Jenkins Script Security Plugin: four Groovy sandbox escapes give code execution on the controllerCVE-2026-92122 · Jenkins Script Security Plugin (Groovy sandbox)High
• Jenkins Robot Framework Plugin: archive path escapes the build directory, allowing arbitrary file writeCVE-2026-92137 · Jenkins Robot Framework Plugin (report archive directory)High
• KubeEdge (ConfigUpdateJob handler, updateFields): REMOTE CODE EXECUTION ON EDGE NODES via a normal Kubernetes APINCVD-2026-051-kubeedge-configupdatejob-handler · KubeEdge (ConfigUpdateJob handler, updateFields)High
• KubeEdge (NodeUpgradeJob handler, v1alpha2 API): REMOTE CODE EXECUTION ON EDGE NODES through the upgrade path. TheNCVD-2026-052-kubeedge-nodeupgradejob-handler · KubeEdge (NodeUpgradeJob handler, v1alpha2 API)High
• APC Network Management Card 4 (NMC4): An unauthenticated attacker can manipulate URL parameters to walk out of the webCVE-2024-58310 · APC Network Management Card 4 (NMC4)High
• GitLab CE/EE: malicious wiki content can drive unauthorized actions as another userCVE-2025-12716 · GitLab CE/EE (wiki page content handling)High