Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities found for Linux openFT by Fujitsu
CVE-2026-16607 (GCVE-0-2026-16607)
Vulnerability from nvd – Published: 2026-07-22 15:07 – Updated: 2026-07-22 18:51
VLAI
EPSS
VEX
Title
Authenticated local root privilege escalation vulnerability in openFT for Linux and Oracle Solaris
Summary
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to root of an already authenticated user on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://security.eu.fsastech.com/IndexDownload.as… | vendor-advisory |
| https://security.ts.fujitsu.com/ProductSecurity/c… | vendor-advisory |
| https://global.fujitsu/de-de/capabilities/mainfra… | mitigation |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fujitsu | Linux openFT |
Unaffected:
12.1D00
(custom)
Affected: 0 , ≤ 12.1C96 (custom) |
|
| Fujitsu | Oracle Solaris openFT |
Unaffected:
12.1D00
(custom)
Affected: 0 , ≤ 12.1C95 (custom) |
Date Public
2026-07-22 18:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16607",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T18:50:41.101711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T18:51:08.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Linux"
],
"product": "Linux openFT",
"vendor": "Fujitsu",
"versions": [
{
"status": "unaffected",
"version": "12.1D00",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.1C96",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Oracle Solaris"
],
"product": "Oracle\u00a0Solaris openFT",
"vendor": "Fujitsu",
"versions": [
{
"status": "unaffected",
"version": "12.1D00",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.1C95",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fujitsu:linux_openft:12.1d00:*:linux:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:fujitsu:linux_openft:*:*:linux:*:*:*:*:*",
"versionEndIncluding": "12.1c96",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fujitsu:oracle_solaris_openft:12.1d00:*:oracle_solaris:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:fujitsu:oracle_solaris_openft:*:*:oracle_solaris:*:*:*:*:*",
"versionEndIncluding": "12.1c95",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"datePublic": "2026-07-22T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in Fujitsu Software Linux openFT and\u0026nbsp;Fujitsu Software Oracle Solaris openFT before version\u0026nbsp;12.1D00 allows for\u0026nbsp;local privilege escalation\u0026nbsp;to root of an already authenticated user on GNU/Linux or Oracle Solaris.\u0026nbsp;\u003cspan\u003eThe Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.\u003c/span\u003e"
}
],
"value": "A vulnerability in Fujitsu Software Linux openFT and\u00a0Fujitsu Software Oracle Solaris openFT before version\u00a012.1D00 allows for\u00a0local privilege escalation\u00a0to root of an already authenticated user on GNU/Linux or Oracle Solaris.\u00a0The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany."
}
],
"impacts": [
{
"capecId": "CAPEC-8",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-8"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T17:50:50.760Z",
"orgId": "763b0cbd-1a52-41de-b280-f255286be201",
"shortName": "FTI"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.eu.fsastech.com/IndexDownload.asp?SoftwareGuid=20873292-0006-4a1c-a188-3940762a0075"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://security.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-FG-2026-042411-Security-Notice.pdf"
},
{
"tags": [
"mitigation"
],
"url": "https://global.fujitsu/de-de/capabilities/mainframe-solutions/bs2000-integration"
}
],
"source": {
"advisory": "FTI-FG-2026-042411",
"discovery": "INTERNAL"
},
"title": "Authenticated local root privilege escalation vulnerability in openFT for Linux and Oracle Solaris",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "763b0cbd-1a52-41de-b280-f255286be201",
"assignerShortName": "FTI",
"cveId": "CVE-2026-16607",
"datePublished": "2026-07-22T15:07:35.516Z",
"dateReserved": "2026-07-22T14:31:14.251Z",
"dateUpdated": "2026-07-22T18:51:08.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16606 (GCVE-0-2026-16606)
Vulnerability from nvd – Published: 2026-07-22 15:14 – Updated: 2026-07-22 18:50
VLAI
EPSS
VEX
Title
Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris
Summary
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://security.eu.fsastech.com/IndexDownload.as… | vendor-advisory |
| https://security.ts.fujitsu.com/ProductSecurity/c… | vendor-advisory |
| https://global.fujitsu/de-de/capabilities/mainfra… | mitigation |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fujitsu | Linux openFT |
Unaffected:
12.1D00
(custom)
Affected: 0 , ≤ 12.1C96 (custom) |
|
| Fujitsu | Oracle Solaris openFT |
Unaffected:
12.1D00
(custom)
Affected: 0 , ≤ 12.1C95 (custom) |
Date Public
2026-07-22 18:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16606",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T18:50:18.361321Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T18:50:25.615Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Linux"
],
"product": "Linux openFT",
"vendor": "Fujitsu",
"versions": [
{
"status": "unaffected",
"version": "12.1D00",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.1C96",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Oracle Solaris"
],
"product": "Oracle\u00a0Solaris openFT",
"vendor": "Fujitsu",
"versions": [
{
"status": "unaffected",
"version": "12.1D00",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.1C95",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fujitsu:linux_openft:12.1d00:*:linux:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:fujitsu:linux_openft:*:*:linux:*:*:*:*:*",
"versionEndIncluding": "12.1c96",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fujitsu:oracle_solaris_openft:12.1d00:*:oracle_solaris:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:fujitsu:oracle_solaris_openft:*:*:oracle_solaris:*:*:*:*:*",
"versionEndIncluding": "12.1c95",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"datePublic": "2026-07-22T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in Fujitsu Software Linux openFT and\u0026nbsp;Fujitsu Software Oracle Solaris openFT before version\u0026nbsp;12.1D00 allows for unauthenticated remote code execution\u0026nbsp;(pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany."
}
],
"value": "A vulnerability in Fujitsu Software Linux openFT and\u00a0Fujitsu Software Oracle Solaris openFT before version\u00a012.1D00 allows for unauthenticated remote code execution\u00a0(pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T17:49:34.478Z",
"orgId": "763b0cbd-1a52-41de-b280-f255286be201",
"shortName": "FTI"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.eu.fsastech.com/IndexDownload.asp?SoftwareGuid=20873292-0006-4a1c-a188-3940762a0075"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://security.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-FG-2026-042411-Security-Notice.pdf"
},
{
"tags": [
"mitigation"
],
"url": "https://global.fujitsu/de-de/capabilities/mainframe-solutions/bs2000-integration"
}
],
"source": {
"advisory": "FTI-FG-2026-042411",
"discovery": "INTERNAL"
},
"title": "Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "763b0cbd-1a52-41de-b280-f255286be201",
"assignerShortName": "FTI",
"cveId": "CVE-2026-16606",
"datePublished": "2026-07-22T15:14:12.557Z",
"dateReserved": "2026-07-22T14:31:08.591Z",
"dateUpdated": "2026-07-22T18:50:25.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16606 (GCVE-0-2026-16606)
Vulnerability from cvelistv5 – Published: 2026-07-22 15:14 – Updated: 2026-07-22 18:50
VLAI
EPSS
VEX
Title
Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris
Summary
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://security.eu.fsastech.com/IndexDownload.as… | vendor-advisory |
| https://security.ts.fujitsu.com/ProductSecurity/c… | vendor-advisory |
| https://global.fujitsu/de-de/capabilities/mainfra… | mitigation |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fujitsu | Linux openFT |
Unaffected:
12.1D00
(custom)
Affected: 0 , ≤ 12.1C96 (custom) |
|
| Fujitsu | Oracle Solaris openFT |
Unaffected:
12.1D00
(custom)
Affected: 0 , ≤ 12.1C95 (custom) |
Date Public
2026-07-22 18:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16606",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T18:50:18.361321Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T18:50:25.615Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Linux"
],
"product": "Linux openFT",
"vendor": "Fujitsu",
"versions": [
{
"status": "unaffected",
"version": "12.1D00",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.1C96",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Oracle Solaris"
],
"product": "Oracle\u00a0Solaris openFT",
"vendor": "Fujitsu",
"versions": [
{
"status": "unaffected",
"version": "12.1D00",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.1C95",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fujitsu:linux_openft:12.1d00:*:linux:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:fujitsu:linux_openft:*:*:linux:*:*:*:*:*",
"versionEndIncluding": "12.1c96",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fujitsu:oracle_solaris_openft:12.1d00:*:oracle_solaris:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:fujitsu:oracle_solaris_openft:*:*:oracle_solaris:*:*:*:*:*",
"versionEndIncluding": "12.1c95",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"datePublic": "2026-07-22T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in Fujitsu Software Linux openFT and\u0026nbsp;Fujitsu Software Oracle Solaris openFT before version\u0026nbsp;12.1D00 allows for unauthenticated remote code execution\u0026nbsp;(pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany."
}
],
"value": "A vulnerability in Fujitsu Software Linux openFT and\u00a0Fujitsu Software Oracle Solaris openFT before version\u00a012.1D00 allows for unauthenticated remote code execution\u00a0(pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T17:49:34.478Z",
"orgId": "763b0cbd-1a52-41de-b280-f255286be201",
"shortName": "FTI"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.eu.fsastech.com/IndexDownload.asp?SoftwareGuid=20873292-0006-4a1c-a188-3940762a0075"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://security.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-FG-2026-042411-Security-Notice.pdf"
},
{
"tags": [
"mitigation"
],
"url": "https://global.fujitsu/de-de/capabilities/mainframe-solutions/bs2000-integration"
}
],
"source": {
"advisory": "FTI-FG-2026-042411",
"discovery": "INTERNAL"
},
"title": "Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "763b0cbd-1a52-41de-b280-f255286be201",
"assignerShortName": "FTI",
"cveId": "CVE-2026-16606",
"datePublished": "2026-07-22T15:14:12.557Z",
"dateReserved": "2026-07-22T14:31:08.591Z",
"dateUpdated": "2026-07-22T18:50:25.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16607 (GCVE-0-2026-16607)
Vulnerability from cvelistv5 – Published: 2026-07-22 15:07 – Updated: 2026-07-22 18:51
VLAI
EPSS
VEX
Title
Authenticated local root privilege escalation vulnerability in openFT for Linux and Oracle Solaris
Summary
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to root of an already authenticated user on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://security.eu.fsastech.com/IndexDownload.as… | vendor-advisory |
| https://security.ts.fujitsu.com/ProductSecurity/c… | vendor-advisory |
| https://global.fujitsu/de-de/capabilities/mainfra… | mitigation |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fujitsu | Linux openFT |
Unaffected:
12.1D00
(custom)
Affected: 0 , ≤ 12.1C96 (custom) |
|
| Fujitsu | Oracle Solaris openFT |
Unaffected:
12.1D00
(custom)
Affected: 0 , ≤ 12.1C95 (custom) |
Date Public
2026-07-22 18:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16607",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T18:50:41.101711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T18:51:08.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Linux"
],
"product": "Linux openFT",
"vendor": "Fujitsu",
"versions": [
{
"status": "unaffected",
"version": "12.1D00",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.1C96",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Oracle Solaris"
],
"product": "Oracle\u00a0Solaris openFT",
"vendor": "Fujitsu",
"versions": [
{
"status": "unaffected",
"version": "12.1D00",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.1C95",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fujitsu:linux_openft:12.1d00:*:linux:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:fujitsu:linux_openft:*:*:linux:*:*:*:*:*",
"versionEndIncluding": "12.1c96",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fujitsu:oracle_solaris_openft:12.1d00:*:oracle_solaris:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:fujitsu:oracle_solaris_openft:*:*:oracle_solaris:*:*:*:*:*",
"versionEndIncluding": "12.1c95",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"datePublic": "2026-07-22T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in Fujitsu Software Linux openFT and\u0026nbsp;Fujitsu Software Oracle Solaris openFT before version\u0026nbsp;12.1D00 allows for\u0026nbsp;local privilege escalation\u0026nbsp;to root of an already authenticated user on GNU/Linux or Oracle Solaris.\u0026nbsp;\u003cspan\u003eThe Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.\u003c/span\u003e"
}
],
"value": "A vulnerability in Fujitsu Software Linux openFT and\u00a0Fujitsu Software Oracle Solaris openFT before version\u00a012.1D00 allows for\u00a0local privilege escalation\u00a0to root of an already authenticated user on GNU/Linux or Oracle Solaris.\u00a0The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany."
}
],
"impacts": [
{
"capecId": "CAPEC-8",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-8"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T17:50:50.760Z",
"orgId": "763b0cbd-1a52-41de-b280-f255286be201",
"shortName": "FTI"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.eu.fsastech.com/IndexDownload.asp?SoftwareGuid=20873292-0006-4a1c-a188-3940762a0075"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://security.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-FG-2026-042411-Security-Notice.pdf"
},
{
"tags": [
"mitigation"
],
"url": "https://global.fujitsu/de-de/capabilities/mainframe-solutions/bs2000-integration"
}
],
"source": {
"advisory": "FTI-FG-2026-042411",
"discovery": "INTERNAL"
},
"title": "Authenticated local root privilege escalation vulnerability in openFT for Linux and Oracle Solaris",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "763b0cbd-1a52-41de-b280-f255286be201",
"assignerShortName": "FTI",
"cveId": "CVE-2026-16607",
"datePublished": "2026-07-22T15:07:35.516Z",
"dateReserved": "2026-07-22T14:31:14.251Z",
"dateUpdated": "2026-07-22T18:51:08.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}