Oracle Solaris CVE-2026-87413

Requires an authenticated local account (PR:L) with the ability to log on to the Oracle Solaris 11.4 infrastructure and interact with the Filesystems component; the flaw cannot be reached remotely or without a valid session (AV:L, no network vector). Exploitation is limited to Oracle Solaris version 11.4 specifically, and impact is confined to availability - no privilege escalation, data disclosure, or code execution results. The low-privilege and local-access prerequisites mean realistic risk is restricted to insiders or an attacker who has already established a foothold on the host.

This is a moderate, availability-only vulnerability that should be prioritized for routine patching rather than emergency response. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: exploitation requires local logon to the host (AV:L) and at least low privileges (PR:L), is easy to trigger (AC:L), and results solely in a complete denial of service (A:H) with no confidentiality or integrity impact (C:N/I:N). No EPSS score, SSVC decision data, KEV listing, or POC was supplied in the intelligence set, so there is no signal of active exploitation or automatable attack - the entire risk picture rests on the Oracle CPU advisory CVSS data. The practical risk is bounded by the local-access and authentication requirements: an attacker must already have a (low-privileged) account on the Solaris host, which limits this to insider, lateral-movement, or multi-stage scenarios rather than internet-facing mass exploitation. In short, this is a legitimately real but low-urgency issue - a denial-of-service nuisance for already-authenticated local users, not a high-impact remote compromise.

A low-privileged local user who already has shell access to an Oracle Solaris 11.4 system invokes a crafted filesystem operation that drives the OS into a hang or a repeatable panic, taking the host offline (complete DoS). No confidential data is exposed and no code is executed; the impact is purely availability. No public exploit code was identified in the provided data.