Oracle Solaris CVE-2026-91244

Exploitation requires an authenticated low-privileged local account (PR:L) on the host where Oracle Solaris 11.4 executes - the attacker must already be able to log on to the infrastructure, so this is not remotely reachable (AV:L). The affected attack surface is the Solaris 'Services' component. High attack complexity (AC:H) further limits exploitation: Oracle explicitly describes the issue as 'difficult to exploit,' implying a timing/race or non-deterministic precondition outside the attacker's full control, likely requiring repeated attempts. No user interaction is needed (UI:N). The realistic impact ceiling is a hang or repeatable crash (complete DOS) of the OS only; there is no path to data disclosure or modification (C:N/I:N). The practical limiting factors are therefore: need for valid local credentials, high complexity, and relevance mainly to shared/multi-user Solaris hosts exposed to untrusted local users.

This is a moderate-severity, availability-only issue (CVSS 3.1 base 4.7) that in practice is a lower priority than the raw score alone might suggest. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) consistently points to a hard-to-exploit local attack: the attacker must already have authenticated local access (PR:L) to the host where Solaris runs, must overcome high attack complexity (AC:H - typically a race condition or precondition the attacker does not fully control), and gains only a denial-of-service outcome (A:H) with no confidentiality or integrity impact (C:N/I:N). There is no EPSS score, no CISA KEV listing, and no public exploit (POC) provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. All signals agree this is NOT a drop-everything priority: the combination of local-only vector, required credentials, high complexity, and DoS-only impact makes it a routine-patch item rather than an urgent threat, most relevant to multi-user or shared Solaris hosts where untrusted local accounts exist. No signals conflict; the primary limitation is simply that only Oracle's own CPU advisory data is available, with no independent exploitation telemetry.

A low-privileged local user with a valid login on a Solaris 11.4 server exploits a flaw in the Services component to repeatedly hang or crash the operating system, producing a complete denial of service. Because attack complexity is high, the attacker likely must win a race condition or satisfy a timing-dependent precondition, so success may require multiple attempts. No public proof-of-concept exploit is available at time of analysis.