EUVD-2026-106256
GHSA-7wfh-973h-76v4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IPS HTTP service over network
-
ExploitSend crafted HTTP request
-
ExecutionExploit Image Packaging System flaw
-
ImpactTake over Oracle Solaris host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Oracle Solaris Image Packaging System (IPS) service over HTTP - in practice, a host running or exposing the IPS package repository/client HTTP endpoint on an attacker-reachable network path. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no authentication, privilege, or user-interaction requirements against affected Solaris 11.3 and 11.4 systems. The primary limiting factor is exposure of the IPS HTTP service: hosts where the IPS endpoint is firewalled off or not network-reachable are not exploitable remotely, which constrains realistic blast radius despite the maximal CVSS score. |
| Impact | This is a genuine high-priority issue, not an inflated high-CVSS score. All CVSS signals align toward severe risk: AV:N (network), AC:L (low complexity, Oracle explicitly calls it 'easily exploitable'), PR:N (unauthenticated), UI:N (no user interaction), with full C:H/I:H/A:H leading to complete host takeover - a textbook 9.8. However, key exploitation-maturity signals are MISSING from the input: there is no EPSS score, no CISA KEV listing, and no evidence of public POC code, so active exploitation cannot be asserted. The one conflicting signal is the 'Information Disclosure' tag, which materially understates a vulnerability that the description characterizes as full 'takeover' with high integrity and availability impact - treat that tag as unreliable. Net: prioritize patching based on the trivial, unauthenticated, network-reachable takeover profile, but note that real-world exploitation volume is currently unknown pending EPSS/KEV data. |
| Exploit ScenarioDerived | An attacker with network reachability to a Solaris host's Image Packaging System HTTP service sends a crafted HTTP request that exploits the flaw without any credentials or user interaction (AV:N/AC:L/PR:N/UI:N), resulting in full compromise of the Oracle Solaris system. Given AC:L and Oracle's 'easily exploitable' wording, reliable exploitation is expected once the flaw is understood. No public exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Full system takeover of Oracle Solaris 11.3 and 11.4 is possible for unauthenticated network attackers who can reach the Image Packaging System (IPS) HTTP service, with high confidentiality, integrity, and availability impact. The 9.8 CVSS score reflects network reachability with low attack complexity, no privileges, and no user interaction, but practical exposure depends on whether the IPS endpoint is accessible from an attacker-reachable network path. No public exploit code or CISA KEV entry was identified at time of analysis.
RemediationAI
Apply the Oracle Solaris IPS fixes published in the October 2026 Critical Patch Update at https://www.oracle.com/security-alerts/cpuoct2026.html; the provided data does not specify an exact patched SRU or version, so confirm the minimum fixed revision in the vendor advisory before treating a host as remediated. Until patched, reduce exposure by firewalling the IPS HTTP endpoint so only trusted package repository clients can reach it, and by disabling or unbinding the IPS repository service on hosts that do not need to serve packages; the trade-off is that legitimate remote package install and update operations will fail until access is restored. Network segmentation limiting which subnets can reach Solaris IPS services adds defense in depth, but it does not correct the underlying flaw. Monitor IPS HTTP access logs for anomalous requests from unexpected sources as a detection measure, recognizing that logging is not a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Solaris IPS is the image packaging framework used for installing, updating, and managing software packages, and it includes HTTP-based repository and client communications. The affected component indicates that the issue resides in how the IPS service handles network requests, but the provided intelligence does not include a CWE or root-cause detail, so the exact defect class cannot be confirmed from the available data. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a remotely reachable, low-complexity target requiring no credentials or user action, with scope unchanged and complete loss of confidentiality, integrity, and availability. No CPE strings were supplied; EUVD identifies Oracle Solaris 11.3 and 11.4 as affected, and exposure is limited to systems where the IPS HTTP endpoint is reachable over the network.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle states easily exploitable, unauthenticated, network HTTP access with full host takeover, so AV:N/AC:L/PR:N/UI:N and C/I/A all High; scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Solaris 11.3 and 11.4 deployments that expose the Image Packaging System HTTP service to attacker-reachable networks face a potential full system takeover, putting hosted workloads, sensitive data, and service availability at risk. Because the vulnerability is rated critical and practical exposure depends primarily on network reachability, leadership should prioritize identifying and isolating affected endpoints until Oracle provides a fix. No public exploit code was identified at time of analysis, which lowers immediate likelihood but does not reduce the need for urgent exposure reduction.
No vendor-released patch identified at time of analysis. Restrict IPS HTTP service reachability to trusted administrative networks via firewalls, ACLs, or security groups; disable the service where unused; segment affected Solaris 11.3/11.4 hosts from untrusted networks; and monitor IPS service and network logs for anomalous access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB