Critical severity · published Jul 22, 2026
CVE-2026-16606
Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Linux openFT · Fujitsu
through 12.1C96 · source: vendor
OO
Oracle Solaris openFT · Fujitsu
through 12.1C95 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16606
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16606
global.fujitsu
https://global.fujitsu/de-de/capabilities/mainframe-solutions/bs2000-integration
security.eu.fsastech.com
https://security.eu.fsastech.com/IndexDownload.asp?SoftwareGuid=20873292-0006-4a1c-a188-3940762a0075
security.ts.fujitsu.com
https://security.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-FG-2026-042411-Security-Notice.pdf
More from Linux openFT
7.8
CVE-2026-16607
Authenticated local root privilege escalation vulnerability in openFT for Linux and Oracle Solaris