Paper/Archive/CVE-2026-16606

CVE-2026-16606

Fujitsu Linux openFT — Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 66.6.666 × 2013.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.

Affected

ProductAffectedFixed inSource

Linux openFT≤ 12.1C9612.1D00CNA

Oracle Solaris openFT≤ 12.1C9512.1D00CNA

Scores by source

FTI (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

FTI (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorysecurity.eu.fsastech.com/IndexDownload.asp?SoftwareGuid=20873292-0006-4a1c-a188-3940762a0075 advisorysecurity.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-FG-2026-042411-Security-Notice.pdf refglobal.fujitsu/de-de/capabilities/mainframe-solutions/bs2000-integration