Oracle Solaris CVE-2026-61202

Exploitation requires the attacker to already have a valid low-privileged local logon to the Solaris host (CVSS PR:L, AV:L) - remote exploitation is not possible. It further requires satisfying a difficult-to-achieve condition (AC:H, described by Oracle as 'difficult to exploit'), meaning special timing, environmental state, or configuration must be met rather than default trivial abuse. Limiting factors: no network vector, mandatory prior authentication as a local user, and high attack complexity; no user interaction by a victim is needed (UI:N). The specific triggering feature within the Utility component is not detailed in the available data and should be confirmed against the Oracle CPU July 2026 advisory.

The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) describes a locally exploitable issue requiring an existing low-privilege account and a difficult-to-exploit condition (AC:H), which materially lowers real-world exploitability versus a remote unauthenticated flaw of the same score. The 7.5 score is driven by high confidentiality and integrity impact plus scope change rather than by ease of exploitation. No EPSS score, SSVC decision, POC, or KEV listing was provided, so exploitation-probability signals are absent; the combination of local access requirement, high complexity, and no evidence of public exploit code suggests this is a real but non-urgent priority best handled in normal patch cycles unless the host is multi-tenant or exposes untrusted local accounts. The vendor 'Authentication Bypass' tag is somewhat in tension with a PR:L (already-authenticated) vector - verify with Oracle whether the bypass is what the utility enables post-logon rather than an initial-access bypass.

An attacker who already holds an unprivileged local account on a Solaris 11.3 or 11.4 server (e.g., a low-tier user on a shared/multi-tenant host) invokes the flawed Utility component under a crafted condition to cross a privilege boundary, gaining read and write access to critical data owned by other authorities. Because attack complexity is high, success may require winning a race or satisfying specific environmental conditions, and no public exploit code is currently known to exist.