Oracle Solaris CVE-2026-34281

Exploitation requires a valid low-privileged local account with the ability to log on to the Oracle Solaris 11.4 system - via SSH, console, or equivalent - which the CVSS PR:L metric confirms. No special Solaris features, non-default configurations, specific kernel options, or elevated privileges beyond a standard user account are identified as prerequisites in the available advisory data. Exploitation is bounded to Oracle Solaris 11.4 only; other versions are not confirmed affected. The SSVC automatable rating of no means an attacker cannot trivially script mass exploitation across multiple systems simultaneously - each target requires individual authenticated access. The local attack vector (AV:L) is the primary limiting factor: remote unauthenticated exploitation is not possible. Scope change amplifies impact in multi-tenant Zone deployments but does not lower the access barrier.

The CVSS 3.1 base score of 6.5 is driven primarily by the scope change and high availability impact, but several signals substantially reduce real-world prioritization urgency. The attack vector is strictly local (AV:L), requiring an attacker to already hold a low-privileged account and logon access to the target system - this significantly narrows the attacker population. EPSS at 0.01% places this in the 2nd percentile of exploitation likelihood, and SSVC independently rates exploitation as none and automatable as no, confirming no observed weaponization. There is no CISA KEV listing and no public POC. The scope change is the most operationally relevant risk signal: in multi-tenant Solaris environments (Zones-based consolidation), a single low-privileged user crashing the kernel affects all co-tenants. For single-tenant Solaris deployments or systems with tightly controlled local access, practical risk is low. This is not a high-priority patch outside of multi-user or multi-tenant Solaris infrastructure.

A low-privileged user with a valid local account on an Oracle Solaris 11.4 system - obtained via compromised credentials or insider access - executes a crafted process or sequence of syscalls that triggers uncontrolled resource exhaustion in a kernel subsystem, eventually causing the kernel to hang or crash. Because of the scope change, all Solaris Zones sharing that kernel instance lose availability simultaneously, multiplying the business impact beyond the single attacker's zone. No public proof-of-concept has been identified, so precise exploitation technique requires knowledge of the specific kernel code path.