CVE-2026-16606: Critical Pre-Auth RCE in Fujitsu openFT (CVSS 9.8)

Executive Summary

A critical pre-authentication remote code execution vulnerability (CVE-2026-16606) has been disclosed in Fujitsu Software openFT, a file transfer software used in enterprise Linux and Oracle Solaris environments. The vulnerability carries a CVSS 3.1 score of 9.8 (Critical) and a CVSS 4.0 score of 9.3 (Critical), and requires no authentication to exploit.

Unauthenticated remote attackers can trigger arbitrary code execution on any affected openFT installation by sending a specially crafted request to the openFT service. A patch is available in version 12.1D00.

Vulnerability Overview

Affected Versions

Attack Vector

The flaw resides in the openFT file transfer daemon. Because no authentication is required prior to triggering the code injection condition (CWE-94), an attacker reachable over the network can exploit the vulnerability to execute arbitrary commands with the privileges of the openFT service process.

1. Attacker identifies host running Fujitsu openFT (any pre-12.1D00 version)
2. Crafted network request sent to openFT service — no credentials required
3. Code injection condition triggered in the openFT daemon
4. Arbitrary code executes under the openFT service account
5. Full host compromise — lateral movement, data exfiltration, persistence

Potential Impact

Immediate Remediation

Step 1: Upgrade to openFT 12.1D00

The patch is available directly from Fujitsu / Fsas Technologies. Upgrade all affected Linux and Solaris openFT installations to version 12.1D00 or later immediately.

Consult the Fujitsu PSIRT advisory (FsasTech-PSIRT-FTI-FG-2026-042411) for upgrade packages and instructions.

Step 2: Restrict Network Access (Immediate Workaround)

If patching is not immediately possible, restrict network access to the openFT service at the firewall or host-based firewall level. Allow connections only from explicitly trusted source IP addresses.

# Example: restrict openFT port using iptables (verify actual port in your config)
iptables -I INPUT -p tcp --dport <openFT-port> ! -s <trusted-ip-range> -j DROP
 
# Or using nftables
nft add rule inet filter input tcp dport <openFT-port> ip saddr != <trusted-ip-range> drop

Step 3: Identify Exposed Instances

# Check for openFT processes running on the system
ps aux | grep -i openft
 
# Check which ports openFT is listening on
ss -tlnp | grep openft
# or
netstat -tlnp | grep openft

Step 4: Check for Signs of Exploitation

# Review openFT service logs for unexpected connections or errors
journalctl -u openft --since "7 days ago"
 
# Check for unexpected processes spawned by the openFT service
# (adjust service user as needed)
ps aux | grep <openft-user>
 
# Look for unexpected cron jobs or scheduled tasks
crontab -l -u <openft-user>

Detection Indicators

Post-Remediation Checklist

1. Confirm patch applied — verify openFT version reports 12.1D00 or later
2. Review firewall rules — ensure openFT port not exposed to untrusted networks
3. Audit service logs — look for anomalous connections or errors prior to patch
4. Check for persistence — review cron jobs, systemd units, and startup scripts
5. Rotate credentials — change passwords for accounts accessible from the openFT host
6. Scan for lateral movement — review adjacent systems for anomalous activity if compromise is suspected

References

• NIST NVD — CVE-2026-16606
• Fsas Technologies PSIRT Advisory: FsasTech-PSIRT-FTI-FG-2026-042411

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• WinRAR CVE-2025-8088 Actively Exploited