Oracle Solaris CVE-2026-87411

Requires an authenticated low-privileged local logon to the Solaris 11.4 host where the vulnerable Filesystems component executes (PR:L, AV:L); there is no remote vector and no user-interaction requirement (UI:N). Exploitation is limited to the single supported affected version, Oracle Solaris 11.4, and impact is confined to availability (system hang or complete DoS) with no data exposure or modification. The key limiting factor is the prerequisite of existing local account access, which constrains this to insider, post-compromise, or shared-host scenarios rather than external attackers.

This is a moderate-risk, availability-only issue best treated as routine patch-cycle priority rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: a low-privileged local user with a valid logon can reliably trigger a hang or repeatable crash (complete DoS) in the Filesystems component, with no confidentiality or integrity impact. The local attack vector (AV:L) is the single biggest risk limiter - an attacker must already have authenticated shell access to the host, so this is not remotely reachable and cannot be used for initial access. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No signals conflict here; rather, key enrichment data (EPSS, CWE) is simply absent, which is expected for a freshly disclosed Oracle Critical Patch Update item. Net: a real but contained local DoS requiring prior authenticated access, not a high-urgency internet-facing threat.

An attacker who already holds a low-privileged local account on a Solaris 11.4 host (e.g., a shell user on a shared or multi-tenant system) issues crafted filesystem operations that drive the Filesystems component into a hang or repeatable kernel crash, taking the entire system offline. No user interaction or elevated privileges are needed, but local logon is mandatory. No public exploit code is identified at time of analysis.