Critical 9.8Published Jul 22, 2026

CVE-2026-16606Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris

Updated under an hour ago (Oct 27, 2026, 8:20 AM ET)

Does this affect you?

It affects Fujitsu Linux openFT and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Fujitsu Linux openFT

Exploited in the last 30 days

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-94
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: FTI
NVD analysis: Deferred
Record last updated: Jul 22, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Fujitsu Linux openFT fujitsu:linux_openft (from the name)	12.1D00 not affected; through 12.1C96	CNA record
Fujitsu Oracle Solaris openFT fujitsu:oracle_solaris_openft (from the name)	12.1D00 not affected; through 12.1C95	CNA record

References

References

https://security.eu.fsastech.com/IndexDownload.asp?SoftwareGuid=20873292-0006-4a1c-a188-3940762a0075	vendor-advisory
https://security.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-FG-2026-042411-Security-Notice.pdf	vendor-advisory
https://global.fujitsu/de-de/capabilities/mainframe-solutions/bs2000-integration	mitigation

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.