Vulnerability · Published Jul 22, 2026 · Assigned by FTI
CVE-2026-16606Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris
Critical 9.8
In plain English
A critical-severity code injection in Linux openFT from Fujitsu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.1%top 33.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fujitsu | Linux openFT | 0 – through 12.1C96 |
| Fujitsu | Oracle Solaris openFT | 0 – through 12.1C95 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://security.eu.fsastech.com/IndexDownload.asp?SoftwareGuid=20873292-0006-4a1c-a188-3940762a0075 vendor-advisory
- https://security.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-FG-2026-042411-Security-Notice.pdf vendor-advisory
- https://global.fujitsu/de-de/capabilities/mainframe-solutions/bs2000-integration mitigation