EUVD-2026-37287Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Network-reachable RAD HTTPS endpoint, no auth or interaction required, privileged daemon yields scope change with full confidentiality and integrity loss; description explicitly states no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data as well as unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
AnalysisAI
Unauthenticated remote compromise of Oracle Solaris 11.4 Remote Administration Daemon (RAD) allows network attackers to read, modify, create, or delete critical data with scope change impacting adjacent products. The CVSS 3.1 base score of 10.0 with AV:N/AC:L/PR:N/UI:N reflects trivial network exploitability over HTTPS without authentication, and no public exploit identified at time of analysis. The scope-change designation indicates that successful exploitation breaches the security authority of RAD and propagates impact to other Solaris-managed components.
Technical ContextAI
The Remote Administration Daemon (RAD) is a Solaris-native service that exposes object-oriented administrative APIs over network transports (including HTTPS) for remote system management, used to control kernel, zones, networking, and service configurations. RAD typically runs with elevated privileges to perform administrative actions, which is why a scope change is plausible - a compromise of RAD's authentication or input handling layer crosses into the privileged administrative authority of the broader Solaris system. No CWE is published by Oracle (consistent with their CPU disclosure practice), but the 'unauthenticated' + 'HTTPS' + 'scope change' combination is consistent with an authentication bypass or improper access control flaw (CWE-287/CWE-862) in the RAD HTTPS transport, aligning with the 'Authentication Bypass' tag supplied with this CVE.
RemediationAI
Apply the Oracle Critical Patch Update for June 2026 to Solaris 11.4 systems as the primary fix, following the patch matrix published at https://www.oracle.com/security-alerts/cspujun2026.html (Patch available per vendor advisory; no specific fix-version string was supplied in the input). Until the CPU is staged, restrict network reachability of the RAD HTTPS transport (default TCP/6788 for rad:remote) to trusted management subnets via host-based packet filter (IPF) or upstream ACLs, or disable the remote transport entirely with 'svcadm disable svc:/system/rad:remote' if remote administration is not required - note that disabling will break any tooling (BUI, RAD clients, zone/cluster orchestration scripts) that relies on remote RAD calls. Audit RAD access logs and authentication events for anomalous HTTPS requests during the exposure window.
More in Oracle Solaris
View allLocal privilege abuse in Oracle Solaris 11.4 allows a low-privileged authenticated user with logon access to the host to
Local denial-of-service in the Oracle Solaris 11.4 Kernel component allows a low-privileged authenticated attacker to ha
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today