CVE-2026-16607: Fujitsu openFT Privilege Escalation Flaw

CVE-2026-16607 Overview

CVE-2026-16607 is a local privilege escalation vulnerability affecting Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00. The flaw allows an authenticated local user on GNU/Linux or Oracle Solaris to escalate privileges to root. The Fsas Technologies PSIRT published the advisory under an existing coordination agreement with Fujitsu Germany. The vulnerability is categorized under [CWE-269] Improper Privilege Management.

Critical Impact
An authenticated local user can obtain full root privileges on affected GNU/Linux and Oracle Solaris systems running openFT, resulting in complete compromise of the host operating system and any managed file transfer data.

Affected Products

Fujitsu Software Linux openFT before version 12.1D00
Fujitsu Software Oracle Solaris openFT before version 12.1D00
Deployments on GNU/Linux and Oracle Solaris hosts

Discovery Timeline

2026-07-22 - CVE-2026-16607 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16607

Vulnerability Analysis

CVE-2026-16607 is a local privilege escalation defect in the openFT managed file transfer product. Fsas Technologies PSIRT identified the issue internally and coordinated the CVE beyond its typical CNA scope. openFT operates as a privileged service on both GNU/Linux and Oracle Solaris, integrating with the operating system to perform authenticated file transfer operations across heterogeneous platforms. Because the vulnerable component runs with elevated privileges, improper privilege management [CWE-269] permits a lower-privileged user to reach a root execution context. The vulnerability requires an authenticated local session, so remote unauthenticated exploitation is not applicable. Successful exploitation compromises confidentiality, integrity, and availability of the host.

Root Cause

The root cause is improper privilege management within openFT components before version 12.1D00. A privileged process, binary, or interprocess boundary trusts input, permissions, or execution context from a less-privileged caller without enforcing appropriate separation. This design flaw enables an authenticated user to influence execution paths that run as root.

Attack Vector

Exploitation requires local access with valid authentication on the target host. The attacker interacts with an openFT interface or component that exposes privileged functionality, then abuses the improper privilege boundary to execute code or actions as root. No user interaction from another party is required. Fujitsu has not published proof-of-concept code, and no public exploit is currently available. Refer to the Fujitsu Security Notice Document for vendor-supplied technical context.

Detection Methods for CVE-2026-16607

Indicators of Compromise

Unexpected root-owned processes spawned from openFT binaries or child processes of the openFT daemon.
New or modified SUID/SGID files in openFT installation directories after user activity.
Audit records showing UID transitions to 0 originating from non-privileged openFT client sessions.
Unexplained modifications to system files, cron entries, or authentication configuration by openFT service accounts.

Detection Strategies

Monitor process execution telemetry for openFT service processes invoking shells, package managers, or arbitrary system utilities.
Enable and review Linux auditd and Solaris BSM/praudit records for setuid, execve, and privilege elevation events tied to openFT.
Baseline expected openFT process trees and alert on deviations, especially child processes running as root from user-initiated transfers.

Monitoring Recommendations

Track file integrity of openFT binaries, configuration files, and privileged helper executables.
Correlate local authentication events with subsequent openFT command execution to identify anomalous session activity.
Retain command-line and parent-child process telemetry from openFT hosts in a centralized log store for retrospective hunting.

How to Mitigate CVE-2026-16607

Immediate Actions Required

Upgrade all Fujitsu openFT installations on GNU/Linux and Oracle Solaris to version 12.1D00 or later.
Inventory hosts running openFT and confirm the installed build against the fixed version.
Restrict local interactive and SSH access on openFT hosts to a minimal, audited set of administrators.
Review recent authentication and process execution logs on openFT hosts for signs of prior abuse.

Patch Information

Fujitsu addresses CVE-2026-16607 in openFT version 12.1D00 and later. Fixed packages are available from the Fujitsu Software Download Resource. Detailed vendor guidance is provided in the Fujitsu Security Notice Document. Additional product context is available in the Fujitsu Mainframe Solutions Overview.

Workarounds

Limit local logon rights on openFT hosts to trusted administrators until patching is complete.
Enforce least privilege on OS accounts that interact with openFT and remove unnecessary shell access.
Increase auditing on openFT hosts to capture privilege transitions and process executions for forensic review.

bash

# Verify installed openFT version on Linux
ftshw -v

# Verify installed openFT version on Oracle Solaris
/opt/openFT/bin/ftshw -v

# Restrict local shell access on openFT hosts (example)
sudo usermod -s /sbin/nologin <non-admin-user>

# Enable auditd rules for privilege escalation events (Linux)
sudo auditctl -a always,exit -F arch=b64 -S execve -F euid=0 -k openft_root_exec