CVE-2026-16606
CRITICALUnauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris
Title source: cnaDescription
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
References (3)
Core 3
Core References
Vendor Advisory vendor-advisory
https://security.eu.fsastech.com/IndexDownload.asp?SoftwareGuid=20873292-0006-4a1c-a188-3940762a0075
Vendor Advisory vendor-advisory
https://security.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-FG-2026-042411-Security-Notice.pdf
Mitigation mitigation
https://global.fujitsu/de-de/capabilities/mainframe-solutions/bs2000-integration
Scores
CVSS v3
9.8
EPSS
0.0065
EPSS Percentile
47.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-94
Status
published
Products (4)
Fujitsu/Linux openFT
< 12.1C96
Fujitsu/Linux openFT
12.1D00
Fujitsu/Oracle Solaris openFT
< 12.1C95
Fujitsu/Oracle Solaris openFT
12.1D00
Published
Jul 22, 2026
Tracked Since
Jul 22, 2026