Oracle Solaris CVE-2026-87417

Exploitation requires network reachability to the Oracle Solaris 11.4 Image Packaging System (pkg) service over HTTP; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, privileges, or user interaction are needed, so any host exposing the IPS/pkg HTTP interface to an attacker is at risk. Limiting factors: only Solaris 11.4 is listed as affected, the impact is confined to confidentiality (information disclosure, no integrity or availability effect), and exposure depends on whether the IPS HTTP service is network-accessible to untrusted parties rather than restricted to an internal/management network. Oracle's CPU description does not disclose the exact feature, endpoint, or configuration that triggers the flaw, so the precise required IPS deployment mode should be verified against the October 2026 Oracle CPU advisory.

Signals are moderate and only partially populated. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an easily exploitable, remote, unauthenticated flaw, which normally argues for prioritization; however the impact is scoped to confidentiality only (C:H/I:N/A:N), so this is information disclosure rather than code execution or takeover, capping the base score at 7.5 (High, not Critical). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation - the 7.5 is therefore a vendor-asserted severity without corroborating exploitation telemetry. This reads as a genuine-but-not-emergency High: real priority for Solaris 11.4 operators, but not a drop-everything issue absent KEV/EPSS evidence. One conflict to verify: the input Tags include 'Authentication Bypass,' yet the CVSS vector is already PR:N (no privileges/authentication required to begin with), so the flaw is better characterized as unauthenticated data access than as a bypass of an existing auth control - treat the 'Authentication Bypass' label with caution. Oracle Critical Patch Update descriptions are also deliberately generic, so the exact attack surface is not fully disclosed.

A remote, unauthenticated attacker with network reachability to a Solaris 11.4 host's Image Packaging System (pkg) HTTP service sends a crafted HTTP request and retrieves data that should be protected, resulting in unauthorized access to critical or all Solaris-accessible data. Low attack complexity (AC:L) and no required privileges or user interaction make the request trivial to deliver once the service is reachable. No public exploit code is identified at time of analysis.