EUVD-2026-24360
GHSA-g44r-j9vh-rwm7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Local attack requiring low-privilege logon; no complexity barrier; scope change reflects cross-Zone kernel crash; zero confidentiality or integrity impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).
AnalysisAI
Local denial-of-service in the Oracle Solaris 11.4 Kernel component allows a low-privileged authenticated attacker to hang or crash the operating system with scope change implications for co-hosted workloads. The vulnerability stems from uncontrolled resource consumption (CWE-400) in the kernel and is addressed in Oracle's April 2026 Critical Patch Update. No public exploit or active exploitation has been identified; EPSS at 0.01% (2nd percentile) and SSVC exploitation rating of none confirm negligible exploitation activity at time of analysis.
Technical ContextAI
The affected component is the Kernel of Oracle Solaris 11.4, identified by CPE cpe:2.3:a:oracle_corporation:oracle_solaris:*:*:*:*:*:*:*:*. The root cause class is CWE-400 (Uncontrolled Resource Consumption), meaning the kernel fails to enforce adequate limits on a finite resource - such as memory allocations, semaphores, file descriptors, or CPU time - when manipulated by a low-privileged local process. The CVSS scope change (S:C) is technically significant in the Solaris context: Oracle Solaris uses Zones for multi-tenant isolation, and a kernel-level crash or hang triggered by one zone's unprivileged user can propagate availability loss across sibling zones and dependent services running on the same kernel instance, explaining why scope escapes the originating process boundary.
RemediationAI
Apply the relevant patch from Oracle's April 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpuapr2026.html. An exact patched release version number is not independently confirmed from available public data beyond the CPU advisory reference - consult Oracle's My Oracle Support portal for the specific patch bundle applicable to Solaris 11.4. Where immediate patching is not feasible, restrict local logon access to only strictly necessary and fully trusted accounts, as the attack requires low-privileged local authentication (PR:L) and reducing the attacker population is the most direct compensating control. In multi-tenant Solaris Zone environments, review zone resource caps using Oracle Solaris resource management (rcapd, project resource controls) to limit the ability of any individual zone's processes to exhaust kernel-level resources; note this may reduce workload performance headroom. Monitoring kernel resource consumption via DTrace or the Solaris fault management architecture (FMA) can help detect anomalous resource exhaustion patterns prior to a crash event.
More in Oracle Solaris
View allUnauthenticated remote compromise of Oracle Solaris 11.4 Remote Administration Daemon (RAD) allows network attackers to
Local privilege abuse in Oracle Solaris 11.4 allows a low-privileged authenticated user with logon access to the host to
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today