Oracle Solaris CVE-2026-91209

Exploitation requires the attacker to already possess a low-privileged authenticated local logon (PR:L) on the Oracle Solaris 11.4 host - there is no remote vector (AV:L). The attacker must additionally trick a different, legitimate user into interacting with attacker-influenced X Window System content (UI:R: 'human interaction from a person other than the attacker'), and must satisfy non-trivial conditions reflected by high attack complexity (AC:H). These factors - mandatory prior local access, dependence on a second human victim, and the narrow conditions needed to win the race/complexity - sharply limit realistic exploitation to multi-user Solaris environments where an untrusted local account can target another user; single-user or tightly restricted-access deployments face negligible risk.

This is a low-priority, high-CVSS-but-low-real-risk issue, and the signals are internally consistent on that point. The Oracle-assigned CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) describes a locally-exploitable flaw requiring existing authenticated access (PR:L), high attack complexity (AC:H), and interaction from a separate human victim (UI:R), yielding only partial Confidentiality, Integrity, and Availability impact - hence the modest 4.2 base score. There is no CISA KEV listing and no public exploit code identified in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is not supplied; its absence is not evidence of risk either way and should not be treated as a signal. SSVC-style reasoning reinforces low urgency: exploitation is not automatable (requires local logon plus a tricked second user), technical impact is partial rather than total, and no active exploitation is reported. The one caveat is that the attack vector is local-only - this is an authenticated insider/foothold-dependent bug, not a remotely reachable one - so it matters mainly on multi-user Solaris hosts where untrusted local accounts coexist with targeted users.

A low-privileged local user with a valid logon on a shared Oracle Solaris 11.4 system crafts malicious input or display content through the X Window System and induces a separate, higher-value user to interact with it (e.g., opening or viewing something on the X display). Because attack complexity is high and user interaction from another person is required, the attacker must win specific timing/configuration conditions; success yields limited read access, limited unauthorized modification, and a partial denial of service. No public proof-of-concept is known.