CVE-2026-21930

low-risk

Published 2026-01-20

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle ZFS Storage Appliance Kit executes to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle ZFS Storage Appliance Kit accessible data. CVSS 3.1 Base Score 2.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 2.3/10 Low

LOCAL / LOW complexity

Affected Products (1)

Sun Zfs Storage Appliance Kit

Affected Vendors

Oracle

References (1)

Vendor Advisory https://www.oracle.com/security-alerts/cpujan2026.html

/ 100

low-risk

Severity 10/34 · Low

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal