Oracle Solaris CVE-2026-60834

Exploitation requires network access to the Oracle Solaris RAD (Remote Administration Daemon) service and valid low-privileged credentials on the target (CVSS PR:L), so it is not remote-unauthenticated. The high attack complexity (AC:H) indicates a further limiting factor - a race condition or environmental precondition the attacker cannot directly control must be met - meaning exploitation is not reliably repeatable on demand. Practical limits: RAD must be reachable over the network (default remote-management deployments), the attacker must already hold some authenticated foothold, and only Oracle Solaris 11.4 is affected. Note the vendor 'Authentication Bypass' tag is inconsistent with PR:L and should be verified, as a true bypass would remove the credential requirement.

The signals are mixed and point to a real but non-trivial-to-exploit issue rather than a mass-exploitation emergency. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N, 7.1) shows network reach and no user interaction, but AC:H means the attacker must win a race condition or meet conditions outside their control, and PR:L means valid low-level credentials are required - both meaningfully raise the bar. The high score is driven largely by the scope change and high confidentiality impact rather than by ease of exploitation. No EPSS score, POC, or KEV listing was provided, so there is no evidence of active or automated exploitation; this reads as a credentialed-insider or post-foothold escalation/disclosure risk. The 'Authentication Bypass' tag appears to conflict with the PR:L in the vector (bypass would imply PR:N) - verify with Oracle whether any authentication is truly required, as this materially changes priority. Overall: prioritize where Solaris hosts sensitive data and RAD is network-exposed, but treat as high-complexity rather than trivially weaponizable.

A low-privileged user with valid Solaris credentials (or an attacker who has phished/compromised such an account) connects to the network-exposed RAD service and issues crafted management requests that exploit the authorization flaw, winning the timing/condition required by the high attack complexity. The result is read access to sensitive data across the system and limited unauthorized modification, with the scope change allowing impact on co-located products. No public exploit code is identified at time of analysis, so a successful attack would require original exploit development against the RAD API.