Fujitsu vulnerabilities
We track 18 vulnerabilities in Fujitsu products across 60+ products. 18 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on July 22, 2026.
Latest Fujitsu vulnerabilities
- 7.8 High severity
Linux openFT: Improper Privilege Management
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to root of an already authenticated user on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtain
- 9.8 Critical severity
Linux openFT: Improper Control of Generation of Code
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelli
- 8.5 High severity
i-フィルター 6.0: Incorrect Default Permissions
Multiple i-フィルター products contain an issue with incorrect default permissions. If this vulnerability is exploited, a local authenticated attacker may replace a service executable on the system where the product is running, potentially allowing arbitrary code e
- 7.5 High severity
IPCOM EX2 Series: Observable Discrepancy
Observable timing discrepancy issue exists in IPCOM EX2 Series V01L02NF0001 to V01L06NF0401, V01L20NF0001 to V01L20NF0401, V02L20NF0001 to V02L21NF0301, and IPCOM VE2 Series V01L04NF0001 to V01L06NF0112. If this vulnerability is exploited, some of the encrypte
- 8.6 High severity
FUJITSU Business Application ID Link Manager II: Absolute Path Traversal
Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, the file contents including sensitive information on the server may be retrieved by an unauthenticated remote attacker.
- 8.2 High severity
Arconte Áurea: Weak Password Recovery Mechanism for Forgotten Password
Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force attack on the emailed PIN number in order to change the password of a legitimate user.
- 8.2 High severity
Arconte Áurea: Improper Authentication
ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate account and cause a denial of service. In addition, a resource has been identified that could allow circu
- 9.8 Critical severity
Arconte Áurea: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Arconte Áurea, in its 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to read sensitive data from the database, modify data (insert/update/delete), perform database administration operations and, i
- 7.5 High severity
Fujitsu Software Infrastructure Manager…: Cleartext Storage of Sensitive Information
Fujitsu Software Infrastructure Manager (ISM) stores sensitive information at the product's maintenance data (ismsnap) in cleartext form. As a result, the password for the proxy server that is configured in ISM may be retrieved. Affected products and versions
- 8.8 High severity
Si-R 30B: Improper Authentication
Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacker to obtain, change, and/or reset configuration settings of the affected products. Affected products and versions are as
- 7.5 High severity
IP-HE950E: Use of Hard-coded Credentials
Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. Affected products and versions are as f
- 7.4 High severity
tsClinical Define.xml Generator and tsClinical…: Improper Restriction of XML External Entity Reference
Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3 to Version 1.1.0. If this vulnerability is exploited, an att
- 9.8 Critical severity
Eternus Cs8000 Firmware: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the grel_finfo function in grel.php. An attacker is able to influence the username (user), password (pw), and file-name (f
- 9.8 Critical severity
Eternus Cs8000 Firmware: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the requestTempFile function in hw_view.php. An attacker is able to influence the unitName POST parameter and inject speci
- 9.8 Critical severity
IPCOM EX2 series, IPCOM EX series, IPCOM VE2…: Improper Neutralization of Special Elements used in an OS Command
The web console of FUJITSU Network IPCOM series (IPCOM EX2 IN(3200, 3500), IPCOM EX2 LB(1100, 3200, 3500), IPCOM EX2 SC(1100, 3200, 3500), IPCOM EX2 NW(1100, 3200, 3500), IPCOM EX2 DC, IPCOM EX2 DC, IPCOM EX IN(2300, 2500, 2700), IPCOM EX LB(1100, 1300, 2300,
- 7.8 High severity
Lifebook A3510 Firmware: Out-of-bounds Write
An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) with BIOS versions before v1.09 (A3510), v2.17 (U9310), v2.30 (U7511/U7411/U7311), v2.33 (U9311), v2.23 (E5510), v2.
- 7.8 High severity
Plugfree Network: Unquoted Search Path or Element
In Fujitsu PlugFree Network <= 7.3.0.3, an Unquoted service path in PFNService.exe software allows a local attacker to potentially escalate privileges to system level.
- 9.8 Critical severity
Apache Struts Improper Input Validation Exploited
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.