Oracle Solaris CVE-2026-87421

Exploitation requires a victim Solaris 11.4 operator to actively use the Image Packaging System (pkg) client over HTTP against attacker-controlled or attacker-influenced package content - i.e. the attacker must either control/compromise the repository the host queries or intercept the cleartext-HTTP package traffic. The decisive limiting factor is UI:R: the flaw cannot be triggered without a human (other than the attacker) initiating a package operation, so hosts that never fetch packages from untrusted sources or that enforce verified HTTPS repositories are materially less exposed. No local access or prior authentication is needed (PR:N), and only Solaris 11.4 is listed as affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N, 7.1 High) describes a network-reachable, unauthenticated flaw of low attack complexity in the Solaris Image Packaging System, but the mandatory UI:R (user interaction) is the single biggest risk-reducer: an attacker cannot act alone and must induce a Solaris operator to perform a package operation against attacker-influenced content. No EPSS score was provided in the input, the CVE is NOT on CISA KEV, and no public exploit is referenced - so there is no public exploit identified at time of analysis. Oracle labels it 'easily exploitable,' yet the combination of required victim interaction, absence of exploitation evidence, and the niche Solaris 11.4 footprint argues this is a genuine-but-moderate priority (patch in the normal Oracle CPU cycle) rather than an emergency. Note a data conflict: the input Tags contain 'Authentication Bypass,' but the description describes unauthorized data read/limited write via a package operation requiring user interaction, not a bypass of authentication - verify tag accuracy with the Oracle advisory.

An attacker stands up or compromises a package repository (or performs an HTTP man-in-the-middle, since the transport is plain HTTP) and lures a Solaris administrator into running an IPS (pkg) install or update against it. When the administrator performs the operation, crafted package or metadata content is processed by the Image Packaging System, granting the attacker unauthorized access to critical Solaris-accessible data and limited unauthorized modification. No public exploit code is referenced in the available data.