EUVD-2026-47266
GHSA-87hm-5j5g-7hm2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local attack vector and low-privilege requirement match description; pure availability impact with no confidentiality or integrity consequence confirmed by DoS-only outcome.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
AnalysisAI
Complete denial-of-service in Oracle Solaris 11.4's Filesystems component allows any low-privileged local user to cause a kernel hang or repeated crash of the operating system. The attack requires only a valid low-privileged logon session and no special configuration, making it trivially repeatable once inside the system. No public exploit code has been identified at time of analysis, and this vulnerability has not been listed in CISA KEV.
Technical ContextAI
The vulnerability resides in the Filesystems subsystem of Oracle Solaris 11.4, a kernel-level component responsible for managing file I/O, virtual filesystem (VFS) operations, and filesystem-specific drivers. No CWE classification has been assigned, so the precise root cause class is unconfirmed; however, a hang or crash triggered by a low-privileged user via filesystem operations in a kernel subsystem is typically indicative of a null pointer dereference, improper resource management, or race condition in kernel code paths accessible through standard filesystem syscalls. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms exploitation is purely local, requires no special configuration or user interaction, and has availability-only impact with unchanged scope - consistent with a kernel panic or deadlock confined to the local system.
RemediationAI
Apply Oracle's Critical Patch Update for July 2026, which addresses CVE-2026-61052 in Oracle Solaris 11.4; the advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number is not independently confirmed beyond the CPU patch bundle reference - administrators should consult the Oracle support portal for the specific patch ID applicable to their Solaris 11.4 installation. Where immediate patching is not feasible, restrict local logon access to the affected system to only thoroughly vetted, trusted accounts and eliminate unnecessary interactive user sessions, which directly shrinks the attacker population. Additionally, enforcing role-based access controls (RBAC) via Oracle Solaris's built-in rbac(7) framework to prevent low-privileged users from invoking specific filesystem-intensive syscalls may provide partial mitigation, though the precise triggering mechanism is unconfirmed. These compensating controls reduce exposure but do not eliminate the underlying kernel vulnerability.
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel RPC). Rated critical s
buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directiv
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Rated high severity
The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from t
ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet.
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of servic
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Common Desktop Environment (C
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today