EUVD-2026-37287Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed RAD HTTPS endpoint
-
DeliverySend crafted unauthenticated request
-
ExploitBypass RAD authentication
-
ExecutionInvoke privileged administrative methods
-
PersistRead or modify critical Solaris data
-
ImpactPivot via scope change to managed subsystems
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only network reachability to the Oracle Solaris 11.4 Remote Administration Daemon's HTTPS transport (typically svc:/system/rad:remote on TCP/6788) - no credentials, no user interaction, no special client configuration. Limiting factors: the RAD remote transport is not enabled by default on all Solaris 11.4 deployments (it is commonly enabled on systems managed via BUI or remote RAD tooling), and best-practice deployments restrict RAD to management VLANs, so internet-exposed instances are likely a minority. Only Solaris 11.4 is confirmed in scope; other Solaris versions are not addressed by this CVE. |
| Impact | All available signals point to maximum urgency: CVSS 3.1 base score is 10.0 with AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction), and S:C (scope change) - the highest-severity profile possible short of full availability impact. No EPSS score, KEV listing, or public POC was supplied in the input, so real-world exploitation pressure cannot be empirically confirmed at this time; however, the trivial exploitation profile against a privileged administrative daemon makes opportunistic mass scanning and rapid weaponization highly likely once technical details circulate. Note that Oracle CPU advisories historically omit CWE and detailed root-cause data, so the specific bug class is inferred from the 'Authentication Bypass' tag rather than confirmed by vendor - verify against the June 2026 CPU advisory once published. |
| Exploit ScenarioDerived | An attacker on a network path to a Solaris 11.4 host's RAD HTTPS port sends a crafted request that bypasses authentication and invokes privileged RAD administrative methods, allowing them to read or modify any data accessible to the daemon - including system configuration, user accounts, and service definitions. Because of the scope change, the same primitive can be leveraged to pivot into other Solaris-managed subsystems (zones, SMF services, kernel parameters) without further authentication. No public exploit identified at time of analysis, but the AC:L/PR:N profile makes scripted mass exploitation straightforward once a POC emerges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Unauthenticated remote compromise of Oracle Solaris 11.4 Remote Administration Daemon (RAD) allows network attackers to read, modify, create, or delete critical data with scope change impacting adjacent products. The CVSS 3.1 base score of 10.0 with AV:N/AC:L/PR:N/UI:N reflects trivial network exploitability over HTTPS without authentication, and no public exploit identified at time of analysis. The scope-change designation indicates that successful exploitation breaches the security authority of RAD and propagates impact to other Solaris-managed components.
RemediationAI
Apply the Oracle Critical Patch Update for June 2026 to Solaris 11.4 systems as the primary fix, following the patch matrix published at https://www.oracle.com/security-alerts/cspujun2026.html (Patch available per vendor advisory; no specific fix-version string was supplied in the input). Until the CPU is staged, restrict network reachability of the RAD HTTPS transport (default TCP/6788 for rad:remote) to trusted management subnets via host-based packet filter (IPF) or upstream ACLs, or disable the remote transport entirely with 'svcadm disable svc:/system/rad:remote' if remote administration is not required - note that disabling will break any tooling (BUI, RAD clients, zone/cluster orchestration scripts) that relies on remote RAD calls. Audit RAD access logs and authentication events for anomalous HTTPS requests during the exposure window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Remote Administration Daemon (RAD) is a Solaris-native service that exposes object-oriented administrative APIs over network transports (including HTTPS) for remote system management, used to control kernel, zones, networking, and service configurations. RAD typically runs with elevated privileges to perform administrative actions, which is why a scope change is plausible - a compromise of RAD's authentication or input handling layer crosses into the privileged administrative authority of the broader Solaris system. No CWE is published by Oracle (consistent with their CPU disclosure practice), but the 'unauthenticated' + 'HTTPS' + 'scope change' combination is consistent with an authentication bypass or improper access control flaw (CWE-287/CWE-862) in the RAD HTTPS transport, aligning with the 'Authentication Bypass' tag supplied with this CVE.
Know when Oracle Solaris gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Network-reachable RAD HTTPS endpoint, no auth or interaction required, privileged daemon yields scope change with full confidentiality and integrity loss; description explicitly states no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data as well as unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
Executive ViewAI
Oracle Solaris 11.4 Remote Administration Daemon (RAD) contains a critical vulnerability (CVE-2026-46978, CVSS 10.0) allowing unauthenticated network attackers to compromise sensitive data and systems without valid credentials. Organizations relying on Solaris infrastructure face immediate risk of data breach, unauthorized system modification, and lateral movement to dependent applications. No vendor patch is currently available, requiring urgent implementation of containment controls.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network segmentation-restrict RAD access via firewall rules to authorized management networks only; (2) Service disablement-halt RAD if operationally acceptable; (3) Access controls-enforce multi-factor authentication for all privileged Solaris operations; (4) Monitoring-deploy real-time alerts on RAD authentication failures, access denials, and administrative actions; (5) Isolation-ensure affected systems cannot reach critical dependent applications. Monitor Oracle Security Alerts daily for vendor-released patches.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Solaris
View allLocal privilege abuse in Oracle Solaris 11.4 allows a low-privileged authenticated user with logon access to the host to
Local denial-of-service in the Oracle Solaris 11.4 Kernel component allows a low-privileged authenticated attacker to ha
GitHub PoC
Exploit-DB