Oracle Solaris, ZFS Appliance flaws patched
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Oracle's October 2026 CPU fixes multiple Solaris and ZFS Storage Appliance vulnerabilities including remote code execution risks; no exploitation reported.
CERT-FR has issued an advisory relaying Oracle's October 2026 Critical Patch Update (CPU), which addresses multiple vulnerabilities affecting Oracle Solaris versions 11.3 and 11.4, as well as Oracle ZFS Storage Appliance Kit version 8.8. The advisory lists 26 CVEs without individual technical descriptions, pointing administrators to Oracle's official security bulletin for details and patches.
According to CERT-FR, successful exploitation of these flaws could allow an attacker to achieve remote arbitrary code execution, trigger a remote denial of service, compromise data confidentiality, affect data integrity, or bypass security policies. No in-the-wild exploitation is mentioned in this advisory. Defenders operating affected Solaris or ZFS Storage Appliance deployments should consult Oracle's cpuoct2026 bulletin to identify which CVEs apply to their specific configuration and apply the corresponding patches.
As this is a vendor patch cycle notification rather than an incident report, prioritization should be based on Oracle's own CVSS scoring and exploitability metrics published in the linked security alert, cross-referenced against exposed Solaris and ZFS Storage Appliance instances in the estate.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1353
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,237 reports from 143 sources, 591 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs