Oracle Solaris CVE-2026-87414

Exploitation targets the Image Packaging System (IPS) component of Oracle Solaris 11.4 and occurs over a network TLS channel. It is explicitly NOT a default-configuration remote-unauthenticated attack: Oracle rates it 'difficult to exploit' (AC:H) and it REQUIRES human interaction from a person other than the attacker (UI:R) - a legitimate administrator or user must perform a packaging action that processes attacker-influenced content. Limiting factors that reduce real-world risk: the required third-party interaction, the high attack complexity, the restriction to Solaris 11.4, and impact limited to partial integrity (unauthorized update/insert/delete of some data) with no confidentiality or availability consequences. Although no authentication is needed (PR:N), the attacker must still occupy a position to influence the TLS-delivered package data.

This is a genuinely low-priority vulnerability, and multiple signals agree rather than conflict. The Oracle-supplied CVSS 3.1 base score is 3.1 (Low), driven by a vector that is hard to exploit (AC:H), requires human interaction from a third party (UI:R), and yields only limited integrity impact (I:L) with no confidentiality or availability loss (C:N/A:N). No EPSS score was provided in the input, there is no CISA KEV listing (KEV=NO), and no public exploit code was identified at time of analysis - so per precision rules this is 'no public exploit identified at time of analysis.' The one notable inconsistency is in the metadata, not the technical data: the input Tag 'Authentication Bypass' does not match the actual vulnerability, which is a low-integrity data-tampering issue requiring victim interaction over TLS, with no authentication bypass described by Oracle. Net assessment: a low-CVSS, low-real-risk issue appropriate for routine patch-cycle remediation rather than emergency response. CWE is listed as N/A and no detailed root-cause mechanism is published, so the precise flaw type is inferred only from Oracle's impact summary.

An attacker positioned to influence a TLS-served package repository or man-in-the-middle a Solaris Image Packaging System (IPS) client session crafts malicious content, then must convince a legitimate Solaris administrator or user to perform a packaging operation that processes it. If the victim interacts as required, the attacker gains limited unauthorized ability to update, insert, or delete some Solaris-accessible data. No public proof-of-concept is known, and the high attack complexity plus required third-party interaction make opportunistic exploitation unlikely.