Vulnerability record · CVE-2025-62290 · published 21 October 2025

CVE-2025-62290: Oracle zfs storage appliance kit improper access control vulnerability

Oracle · Zfs Storage Appliance Kit

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Block Storage). The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful attacks of this vulnerability can result in takeover of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

7.2 CVSS 3.1 High EPSS 0.35% · top 73.9% CWE-284 · Improper access control

7.2CVSS 3.1 base score

0.35%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

1References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Zfs Storage Appliance Kit Oracle

References

Link	Tags
https://www.oracle.com/security-alerts/cpuoct2025.html	Vendor Advisory

Track CVE-2025-62290 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.0CVE-2021-40438Apache HTTP Server mod_proxy SSRF via crafted URI pathA crafted request URI path can make mod_proxy forward the request to an origin server chosen by the remote user, an SSRF flaw in Apache HTTP Server 2…KEVEPSS 100%analysed16 Sep 2021 7.8CVE-2021-4034polkit pkexec argument handling flaw allows local root escalationpkexec, the setuid polkit utility for running commands as privileged users, mishandles the calling parameter count and ends up treating environment v…KEVEPSS 94%analysed28 Jan 2022 5.5CVE-2020-1472Microsoft Netlogon elevation of privilege via vulnerable secure channel (Zerologon)CVE-2020-1472 is an elevation of privilege flaw in Microsoft's Netlogon Remote Protocol (MS-NRPC) where an attacker can establish a vulnerable Netlog…KEVEPSS 99%analysed17 Aug 2020 9.8CVE-2022-22720Apache http server http request smuggling vulnerabilityApache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server …EPSS 28%14 Mar 2022 9.8CVE-2022-23943Apache HTTP Server mod_sed heap out-of-bounds writemod_sed in Apache HTTP Server 2.4.52 and earlier contains an out-of-bounds write (linked to an integer overflow) that lets an attacker overwrite heap…EPSS 50%analysed14 Mar 2022 9.8CVE-2022-25315Libexpat project libexpat integer overflow vulnerabilityIn Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.EPSS 4.8%18 Feb 2022 9.8CVE-2022-25235Libexpat project libexpat vulnerabilityxmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a c…EPSS 5.0%16 Feb 2022 9.8CVE-2022-25236Libexpat project libexpat exposure of resource to wrong sphere vulnerabilityxmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.EPSS 36%16 Feb 2022

Source: NIST National Vulnerability Database (record CVE-2025-62290), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.