# Oracle Solaris, ZFS Appliance flaws patched

Published: 2026-10-21 · Severity: routine · Sectors: Technology, Infrastructure
Canonical: https://vorant.io/reports/c35b5843-e74b-5a7c-b0b3-7dd0434addd2/oracle-solaris-zfs-appliance-flaws-patched

> Oracle's October 2026 CPU fixes multiple Solaris and ZFS Storage Appliance vulnerabilities including remote code execution risks; no exploitation reported.

CERT-FR has issued an advisory relaying Oracle's October 2026 Critical Patch Update (CPU), which addresses multiple vulnerabilities affecting Oracle Solaris versions 11.3 and 11.4, as well as Oracle ZFS Storage Appliance Kit version 8.8. The advisory lists 26 CVEs without individual technical descriptions, pointing administrators to Oracle's official security bulletin for details and patches.

According to CERT-FR, successful exploitation of these flaws could allow an attacker to achieve remote arbitrary code execution, trigger a remote denial of service, compromise data confidentiality, affect data integrity, or bypass security policies. No in-the-wild exploitation is mentioned in this advisory. Defenders operating affected Solaris or ZFS Storage Appliance deployments should consult Oracle's cpuoct2026 bulletin to identify which CVEs apply to their specific configuration and apply the corresponding patches.

As this is a vendor patch cycle notification rather than an incident report, prioritization should be based on Oracle's own CVSS scoring and exploitability metrics published in the linked security alert, cross-referenced against exposed Solaris and ZFS Storage Appliance instances in the estate.

## Mentioned in this report

- Vulnerabilities: CVE-2026-101537, CVE-2026-101597, CVE-2026-47025, CVE-2026-60432, CVE-2026-60453, CVE-2026-60662, CVE-2026-87411, CVE-2026-87413, CVE-2026-87414, CVE-2026-87417, CVE-2026-87421, CVE-2026-87422, CVE-2026-87423, CVE-2026-91208, CVE-2026-91209, CVE-2026-91242, CVE-2026-91244, CVE-2026-91249, CVE-2026-91252, CVE-2026-91253, CVE-2026-91254, CVE-2026-91255, CVE-2026-91256, CVE-2026-91324, CVE-2026-91336, CVE-2026-91348, CVE-2026-91527, CVE-2026-91537

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1353

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c35b5843-e74b-5a7c-b0b3-7dd0434addd2/oracle-solaris-zfs-appliance-flaws-patched.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup