Remote Code Execution Vulnerability in Fujitsu Software's openFT for GNU/Linux and Oracle Solaris
CVE-2026-16606

9.3CRITICAL

Key Information:

Vendor

Fujitsu

Status
Linux Openft
Oracle solaris Openft
Vendor
CVE Published:
22 July 2026

What is CVE-2026-16606?

A vulnerability has been identified in Fujitsu Software's openFT for GNU/Linux and Oracle Solaris, allowing unauthenticated remote code execution. This issue affects versions prior to 12.1D00 and poses a significant risk to system security. Attackers could exploit this vulnerability to execute arbitrary code on affected systems without prior authentication. Fujitsu's PSIRT has acknowledged this vulnerability and published notices detailing the risks and mitigation strategies.

Affected Version(s)

Linux openFT Linux 12.1D00

Linux openFT Linux 0 <= 12.1C96

Oracle Solaris openFT Oracle Solaris 12.1D00

References

https://security.eu.fsastech.com/IndexDownload.asp?Softwa...
vendor-advisory
https://security.ts.fujitsu.com/ProductSecurity/content/F...
vendor-advisory
https://global.fujitsu/de-de/capabilities/mainframe-solut...
mitigation

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.