CVE-2026-91254: High severity Oracle Solaris vulnerability
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Oracle Solaris systems running the supported affected version, 11.4, are exposed if they are reachable by an attacker over HTTP. No authentication or user interaction is required.
What does an attacker need to exploit it?
An attacker needs network access to the affected Oracle Solaris system via HTTP. The vulnerability is described as easily exploitable and has low attack complexity.
What is the likely impact of successful exploitation?
Successful exploitation can allow an attacker to cause a system hang or a frequently repeatable crash, resulting in a complete denial of service. The stated impact is limited to availability; no confidentiality or integrity impact is specified.
Is a default configuration known to be affected?
The available information identifies Oracle Solaris 11.4 as affected but does not state whether HTTP exposure is enabled in a default configuration.