Oracle Solaris CVE-2026-91249

Exploitation requires an attacker to already have a valid low-privileged logon to the infrastructure where Oracle Solaris 11.4 runs (PR:L), and the attack is strictly local (AV:L) with no remote vector and no user interaction. Limiting factors: only Oracle Solaris version 11.4 is listed as affected; the attacker must possess working local credentials; and impact is confined to unauthorized read access to a subset of data (C:L, no integrity or availability impact), so it cannot be used for code execution, modification, or denial of service on its own.

This is a low-severity issue, not a priority. The CVSS 3.1 base score of 3.3 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates a locally-exploitable, low-complexity flaw requiring an already-authenticated low-privileged account, yielding only partial confidentiality impact (C:L) with no integrity or availability effect. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the provided data, so there is no public exploit identified at time of analysis and no signal of active or widespread exploitation. The signals are internally consistent - a modest-impact local information-disclosure bug - with no conflicts between CVSS, exploitation status, and description. The one notable data discrepancy is a 'Authentication Bypass' tag that does not match the described behavior (local read access by an already-logged-in low-privileged user), which should be disregarded. Realistically this is a high-noise-floor, low-real-risk finding that belongs in routine Oracle Critical Patch Update remediation rather than emergency patching.

A low-privileged user already able to log on to a Solaris 11.4 host abuses a flaw in a system Library to read a subset of data they should not have access to, such as fragments of another user's or process's memory or files. The attack is local-only and requires valid credentials on the machine; no public exploit code is known, and there is no evidence of active exploitation.