Oracle ZFS Storage Appliance Kit vulnerabilities

117 CVEs affecting Oracle ZFS Storage Appliance Kit, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-62480, published 2025-10-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF), published 2021-09-16. Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2021-12-01. EPSS: 100% chance of exploitation in the next 30 days. A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2020-1472: Microsoft Netlogon Privilege Escalation Vulnerability, published 2020-08-17. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.4% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An…
CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability, published 2022-01-28. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-27. EPSS: 94.9% chance of exploitation in the next 30 days. A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users…
CVE-2021-44790, published 2021-12-20. Critical severity, CVSS 9.8. EPSS: 96.8% chance of exploitation in the next 30 days. A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the…
CVE-2020-11984, published 2020-08-07. Critical severity, CVSS 9.8. EPSS: 90% chance of exploitation in the next 30 days. Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
CVE-2020-9490, published 2020-08-07. High severity, CVSS 7.5. EPSS: 88.8% chance of exploitation in the next 30 days. Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a…
CVE-2021-3711, published 2021-08-24. Critical severity, CVSS 9.8. EPSS: 87.8% chance of exploitation in the next 30 days. In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the…
CVE-2022-22719, published 2022-03-14. High severity, CVSS 7.5. EPSS: 69.1% chance of exploitation in the next 30 days. A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
CVE-2021-26691, published 2021-06-10. Critical severity, CVSS 9.8. EPSS: 68.3% chance of exploitation in the next 30 days. In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow
CVE-2021-26690, published 2021-06-10. High severity, CVSS 7.5. EPSS: 65.3% chance of exploitation in the next 30 days. Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

Latest

CVE-2025-62480, published 2025-10-21. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Naming Subsystem). The supported version that is affected is 8.8. Easily exploitable vulnerability allows…
CVE-2025-62479, published 2025-10-21. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The supported version that is affected is 8.8. Easily exploitable vulnerability allows…
CVE-2025-62478, published 2025-10-21. Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store). The supported version that is affected is 8.8. Easily exploitable vulnerability allows…
CVE-2025-62477, published 2025-10-21. Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remote Replication). The supported version that is affected is 8.8. Easily exploitable vulnerability…
CVE-2025-62476, published 2025-10-21. Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Remote Replication). The supported version that is affected is 8.8. Easily exploitable vulnerability…
CVE-2025-62475, published 2025-10-21. Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily exploitable vulnerability allows high…
CVE-2025-62290, published 2025-10-21. High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The supported version that is affected is 8.8. Easily exploitable vulnerability allows…
CVE-2025-62289, published 2025-10-21. Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). The supported version that is affected is 8.8. Easily exploitable vulnerability allows high…
CVE-2025-53046, published 2025-10-21. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Analytics). The supported version that is affected is 8.8. Easily exploitable vulnerability allows high…
CVE-2024-21155, published 2024-07-16. Medium severity, CVSS 4.7. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: User Interface). The supported version that is affected is 8.8. Easily exploitable vulnerability allows…