CVE-2026-16606CWE-94

Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris

Critical · published July 22, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
66.3
In the wild
Unconfirmed
What it is

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01137 · 66.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-07-22T15:14Z
EPSS history
Timeline
  • 22 JUL 15:14Z
    Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris
    cvelistv5