CVE-2026-16606: Fujitsu openFT RCE Vulnerability

CVE-2026-16606 Overview

CVE-2026-16606 is a pre-authentication remote code execution (RCE) vulnerability affecting Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00. Attackers can execute arbitrary code on GNU/Linux or Oracle Solaris hosts running vulnerable openFT installations without any authentication or user interaction. The Fsas Technologies PSIRT confirmed the flaw internally and published a security notice covering the issue beyond its CNA scope under an existing agreement with Fujitsu Germany. The underlying weakness is classified as [CWE-94] Improper Control of Generation of Code (Code Injection).

Critical Impact
Unauthenticated network attackers can achieve full remote code execution on openFT servers, leading to confidentiality, integrity, and availability compromise of file-transfer infrastructure.

Affected Products

Fujitsu Software Linux openFT before version 12.1D00
Fujitsu Software Oracle Solaris openFT before version 12.1D00
openFT deployments on GNU/Linux and Oracle Solaris hosts

Discovery Timeline

2026-07-22 - CVE-2026-16606 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16606

Vulnerability Analysis

CVE-2026-16606 resides in Fujitsu openFT, a managed file transfer product used to move data between enterprise systems, including mainframe and Unix environments. The vulnerability allows an unauthenticated attacker on the network to trigger code execution on the openFT host. Because openFT typically runs with elevated service privileges, successful exploitation grants attackers substantial control over the target system and any files it processes.

The advisory from Fsas Technologies PSIRT (FTI-FG-2026-042411) confirms that both the Linux and Oracle Solaris builds of openFT are affected prior to version 12.1D00. openFT servers frequently sit at trust boundaries between segmented networks, making this class of flaw useful for lateral movement into file-transfer, mainframe integration, and batch-processing environments.

Root Cause

The issue is categorized under [CWE-94] Improper Control of Generation of Code. This class of weakness occurs when input received from an untrusted source is incorporated into code that the application later evaluates or executes. In the context of openFT, this permits a remote attacker to influence code paths executed by the server process without first authenticating.

Attack Vector

The attack vector is network-based, requires no privileges, and requires no user interaction. An attacker who can reach the openFT service port can send crafted protocol messages that cause the server to execute attacker-controlled code. Public proof-of-concept code is not currently available, and Fsas Technologies PSIRT indicates the intelligence was obtained internally.

Technical exploitation details are not published in the advisory. Refer to the Fujitsu Security Notice FTI-FG-2026-042411 for vendor guidance.

Detection Methods for CVE-2026-16606

Indicators of Compromise

Unexpected child processes spawned by the openFT service account on Linux or Solaris hosts.
Outbound network connections initiated from openFT server processes to unfamiliar destinations.
New or modified files, cron jobs, or startup scripts owned by the openFT service user.
Anomalous inbound traffic to openFT listening ports from untrusted network zones.

Detection Strategies

Inventory all Linux and Solaris systems running openFT and compare installed versions against 12.1D00 or later.
Inspect openFT logs for malformed protocol messages, unexpected session terminations, or repeated connection attempts from unknown peers.
Monitor process ancestry to detect shells, interpreters, or download utilities launched by the openFT service.

Monitoring Recommendations

Enable host-based logging of process creation and command-line arguments on all openFT servers.
Forward openFT service logs and operating system audit logs to a centralized analytics platform for correlation.
Alert on any interactive shell activity or outbound HTTP/HTTPS connections originating from the openFT service account.

How to Mitigate CVE-2026-16606

Immediate Actions Required

Upgrade all Fujitsu openFT instances on Linux and Oracle Solaris to version 12.1D00 or later.
Restrict network access to openFT listener ports so that only authorized peers and management hosts can connect.
Audit openFT service accounts and rotate any credentials, keys, or partner profiles that may have been exposed.
Review recent transfer activity for unexpected jobs, destinations, or partner definitions.

Patch Information

Fsas Technologies has released fixed builds of openFT for Linux and Oracle Solaris. Patched software is available through the FSAS Tech Software Resource Download portal. Vendor guidance is documented in the Fujitsu Security Notice FTI-FG-2026-042411. Additional context on Fujitsu integration products is available in the Fujitsu Mainframe Integration Overview.

Workarounds

Place openFT servers behind firewalls or jump hosts and permit inbound traffic only from explicitly authorized partner IP addresses.
Disable or stop the openFT service on hosts where upgrade to 12.1D00 cannot be completed immediately.
Enforce network segmentation between openFT servers and general user or internet-facing segments until patching is complete.

bash

# Example: restrict openFT listener to trusted partner subnets using iptables
iptables -A INPUT -p tcp --dport 1100 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1100 -j DROP

# Verify installed openFT version on Linux
ftshw -v