Oracle Solaris CVE-2026-91208

Exploitation requires the attacker to already have an interactive local logon to the infrastructure where Oracle Solaris 11.4 runs (AV:L) - remote network exploitation is not possible. The flaw resides in the Solaris 'Services' component, and the high attack complexity (AC:H) means success depends on specific, attacker-uncontrolled runtime conditions (e.g., timing or state in the targeted service), which substantially limits reliable exploitation. No authentication is scored as required (PR:N) and no user interaction is needed (UI:N), but the mandatory local logon and the narrow triggering conditions are the key limiting factors; impact is confined to a non-persistent availability loss (hang/crash) on the single affected host (S:U).

This is a moderate-severity, low-priority availability issue rather than an urgent threat. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.1) describes a local-only attack (AV:L) with high exploit complexity (AC:H) and availability-only impact - a complete but non-persistent denial of service (hang or repeatable crash) with no confidentiality or integrity effect. No EPSS score was supplied, the CVE is not in CISA KEV, and no public exploit is referenced, so there is no evidence of real-world exploitation. One notable tension: Oracle scores this PR:N (no privileges), yet the description states the attacker must have 'logon to the infrastructure where Oracle Solaris executes' - Oracle treats the required local logon as the AV:L attack vector rather than as a privilege, but defenders should understand that practical exploitation still requires an existing local account/session. Combined with AC:H (special conditions the attacker cannot fully control), real-world risk is limited to environments where untrusted users already have local shell access. Overall: a genuine but low-urgency DOS bug, not a high-risk priority.

An attacker who already holds a local login session on a Solaris 11.4 host triggers a flaw in a Services component that, under specific hard-to-control conditions, forces the operating system to hang or repeatedly crash, denying service to all users. No public proof-of-concept is known, and the high attack complexity means the attacker must line up specific runtime conditions. Impact is limited to availability - no data disclosure or modification occurs.