An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products.

published 2022-12-26 3 y ago modified 2026-06-17 4 mo ago also EUVD-2019-18950

cvss: 8.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits: 0; none known

An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products. The SMB server allows an attacker to have unintended access, e.g., an attacker with WRITE_XATTR can change permissions. This occurs because of a combination of three factors: ZFS extended attributes are used to implement NT named streams, the SMB protocol requires implementations to have open handle semantics similar to those of NTFS, and the SMB server passes along certain attribute requests to the underlying object (i.e., they are not considered to be requests that pertain to the named stream).

Patch / fix

links 2

illumos.org/issues/10506 advisory
oracle.com/security-alerts/cpuapr2020.html advisory

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 18 mo ago (2025-04-14)

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CNA	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Classification

Weakness

CWE-276 Incorrect Default Permissions

References

illumos.org /issues/10506
mitigation, patch, vendor-advisory
oracle.com /security-alerts/cpuapr2020.html
patch, third-party-advisory

Sources

CVE List CVE-2019-9579
NVD CVE-2019-9579

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary