Oracle Solaris CVE-2026-87423

Exploitation requires an interactive local logon to the Oracle Solaris 11.4 host with at least low (standard user) privileges - it is not remotely reachable (AV:L) and not unauthenticated. The attacker must interact with the X Window System component, and success is gated by high attack complexity (AC:H), implying a race condition or specific non-deterministic runtime state the attacker cannot fully control. Limiting factors: no remote vector, pre-existing local account needed, difficult-to-win timing/state conditions, and the component must be present/in use; impact is capped at partial read, partial modification, and partial DoS with no privilege gain.

This is a genuinely low-priority vulnerability despite affecting an enterprise OS. The CVSS 3.1 base score is 4.5 (Medium), and the vector (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) describes a constrained issue: the attacker needs local logon access (AV:L), already holds low privileges (PR:L), and must overcome high attack complexity (AC:H), meaning success depends on conditions outside the attacker's control (e.g., race conditions or specific runtime state). All impacts are rated Low (C:L/I:L/A:L) - only partial data read, partial unauthorized modification, and partial denial of service, with no privilege escalation and unchanged scope (S:U). No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit identified, so there is no signal of active or imminent exploitation. No SSVC decision data was supplied. The combination of required local authenticated access, high complexity, and uniformly Low impact places this well below items warranting urgent patching; it should be remediated during the normal Oracle Critical Patch Update cycle rather than treated as an emergency.

An attacker who already has a low-privileged local login on a Solaris 11.4 host (e.g., a standard user shell) interacts with the X Window System component and, by winning a timing/state-dependent condition (reflecting the high attack complexity), manages to read a subset of accessible data, make limited unauthorized modifications, or partially disrupt service. No public exploit code is identified, and the high complexity makes reliable exploitation difficult.