A vulnerability in the Core component of Oracle ZFS Storage Appliance Kit allows an attacker with low privileges and network access via HTTP to fully compromise the appliance. The weakness enables exploitation that can lead to complete takeover, exposing the system to confidentiality, integrity, and availability breaches. The CVSS score of 8.8 highlights the severity of the impact on all critical security dimensions.

Oracle Corporation’s ZFS Storage Appliance Kit version 8.8 is affected. Users deploying this appliance should verify their installed version against the vendor’s advisory and consider the appliance’s core services exposed over HTTP as attack vectors.

The attack requires only low privileged access and network connectivity to the HTTP interface, making it easily exploitable for adversaries with minimal resources. The CVSS score of 8.8 reflects high confidence in the exploitability. No EPSS score is available, and the vulnerability is not yet listed in CISA KEV, but the absence of a mitigation does not reduce the risk of a successful breach.