The vulnerability resides in the Core component of the Oracle ZFS Storage Appliance Kit. An unauthenticated attacker with network access via HTTP can exploit it to read a subset of data that is normally protected. The flaw leads to a moderate confidentiality impact, as reflected by the CVSS 3.1 base score of 5.3, which indicates that the attacker could read information that the appliance stores. The vulnerability does not affect integrity or availability but allows an attacker to access data that should be restricted.

Oracle ZFS Storage Appliance Kit version 8.8 is affected by this flaw.

The CVSS score of 5.3 places the vulnerability in the medium category. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network based: an unauthenticated user connecting over HTTP to the appliance can trigger the read operation. Because authentication is not required and the access path is exposed over a network protocol, attackers could exploit this without additional privileges.