Description

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to root of an already authenticated user on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-07-22T16:17:16.963Z",
  "pubdate": "2026-07-22T16:17:16.963Z",
  "executiveSummary": "A local privilege escalation vulnerability exists in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00. This security flaw allows an already authenticated local user to elevate their privileges to root on affected GNU/Linux and Oracle Solaris operating systems. The vulnerability poses significant risk to host integrity and confidentiality, as a successful exploit grants full administrative control over the underlying operating system. Exploitation requires prior local authentication to the target system, leveraging internal weaknesses within the openFT software architecture to achieve unauthorized privilege escalation. The vulnerability details were obtained internally by the Fsas Technologies PSIRT and are covered under an existing agreement with Fujitsu Germany. Organizations utilizing vulnerable versions of openFT face potential complete system compromise if local users execute unauthorized privilege escalation routines against the vulnerable components. Immediate remediation requires applying vendor-supplied updates or migrating to version 12.1D00 or later to neutralize the escalation vector.",
  "technicalDetails": "The vulnerability resides within Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT prior to version 12.1D00, specifically impacting local privilege boundaries managed by the openFT software suite. The root cause stems from improper privilege management and authorization checks within the application execution or component interaction flow, allowing users with standard privileges to execute administrative functions or manipulate execution contexts to inherit root capabilities. The attack vector requires the adversary to possess prior local access and valid authentication to the host system running the vulnerable openFT software. During exploitation, an authenticated local user interacts with insecurely implemented openFT components, binaries, or services that execute with elevated privileges. Due to insufficient input validation, flawed access control enforcement, or insecure inter-process communication handling, the application improperly honors user-supplied control data or environment parameters. This enables the attacker to orchestrate a privilege boundary bypass, transitioning execution flow into a context with root privileges. The post-exploitation impact includes complete system compromise, enabling the attacker to read, modify, or delete arbitrary files, install persistent backdoors, and execute administrative commands across the entire GNU/Linux or Oracle Solaris operating system instance. Because the flaw facilitates escalation from an authenticated standard user directly to the root security context, normal multi-user isolation mechanisms on the host are effectively subverted."
}