# Oracle Patches Dozens of Solaris, ZFS Flaws

Published: 2026-10-21 · Severity: routine
Canonical: https://vorant.io/reports/70826fcd-e8f9-5d06-a73c-fcff798fa2d5/oracle-patches-dozens-of-solaris-zfs-flaws

> CERT-FR relays Oracle's October 2026 CPU patching 27 vulnerabilities in Solaris 11.3/11.4 and ZFS Storage Appliance, some allowing remote code execution.

CERT-FR issued an advisory summarizing Oracle's October 2026 Critical Patch Update (CPU) affecting Oracle Solaris versions 11.3 and 11.4, as well as Oracle ZFS Storage Appliance Kit version 8.8. The bulletin covers 27 distinct CVEs, some of which allow an attacker to achieve remote code execution, cause denial of service, bypass security controls, or compromise data confidentiality and integrity. No proof-of-concept exploitation or in-the-wild attacks are mentioned in the advisory.

As is typical for Oracle's quarterly CPU advisories, no technical details on individual vulnerabilities, attack vectors, or exploitability are provided in this CERT-FR summary; organizations should consult Oracle's official security bulletin (cpuoct2026) for per-CVE CVSS scores, affected components, and patch guidance. Defenders running Oracle Solaris or ZFS Storage Appliance should apply the October 2026 CPU patches as soon as operationally feasible given the presence of remote code execution vectors among the fixed issues.

## Mentioned in this report

- Vulnerabilities: CVE-2026-101537, CVE-2026-101597, CVE-2026-47025, CVE-2026-60432, CVE-2026-60453, CVE-2026-60662, CVE-2026-87411, CVE-2026-87413, CVE-2026-87414, CVE-2026-87417, CVE-2026-87421, CVE-2026-87422, CVE-2026-87423, CVE-2026-91208, CVE-2026-91209, CVE-2026-91242, CVE-2026-91244, CVE-2026-91249, CVE-2026-91252, CVE-2026-91253, CVE-2026-91254, CVE-2026-91255, CVE-2026-91256, CVE-2026-91324, CVE-2026-91336, CVE-2026-91348, CVE-2026-91527, CVE-2026-91537

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1353

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/70826fcd-e8f9-5d06-a73c-fcff798fa2d5/oracle-patches-dozens-of-solaris-zfs-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup