What is the CVSS score of CVE-2026-21928?

CVE-2026-21928 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Solaris are affected by CVE-2026-21928?

CVE-2026-21928 presents moderate security risk, a information exposure vulnerability rated CVSS 5.3. Sensitive information could be exposed to unauthorized parties.

How to fix or mitigate CVE-2026-21928?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Solaris CVE-2026-21928

MEDIUM

Information Exposure (CWE-200)

2026-01-20 secalert_us@oracle.com

Oracle Linux Solaris

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 20, 2026 - 22:15 nvd

MEDIUM 5.3

DescriptionCVE.org

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. [CVSS 5.3 MEDIUM]

Technical ContextAI

Classified as CWE-200 (Information Exposure). Affects Solaris. Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Solaris

View all

CVE-2017-3623 CRITICAL Act Now POC

10.0 Apr 24

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel RPC). Rated critical s

CVE-2016-2776 HIGH Act Now POC

7.5 Sep 28

buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly

CVE-2017-5753 MEDIUM This Month POC

5.6 Jan 04

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of

CVE-2016-4971 HIGH Act Now POC

8.8 Jun 30

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F

CVE-2015-4024 MEDIUM This Month POC

5.0 Jun 09

Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.

CVE-2013-5704 MEDIUM This Month POC

5.0 Apr 15

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directiv

CVE-2017-3629 HIGH Act Now POC

7.8 Jun 22

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Rated high severity

CVE-2015-3145 HIGH Act Now

7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2016-5387 HIGH Act Now

8.1 Jul 19

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from t

CVE-2016-4957 HIGH Act Now

7.5 Jul 05

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet.

CVE-2014-7142 MEDIUM This Month

6.4 Nov 26

The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of servic

CVE-2017-3622 HIGH Act Now POC

7.8 Apr 24

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Common Desktop Environment (C

Same weakness CWE-200 – Information Exposure

View all

CVE-2016-6415 HIGH POC

7.5

CVE-2013-7331 MEDIUM POC

6.5

CVE-2025-31125 MEDIUM POC

5.3

CVE-2025-11749 CRITICAL POC

9.8

CVE-2017-16894 HIGH POC

7.5

CVE-2017-11165 CRITICAL POC

9.8

CVE-2016-2388 MEDIUM POC

5.3

CVE-2016-1561 HIGH POC

7.5

CVE-2026-21928 vulnerability details – vuln.today

Back

Solaris CVE-2026-21928

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Solaris

Same weakness CWE-200 – Information Exposure

Share

External POC / Exploit Code