Oracle Solaris CVE-2026-91252

The affected Solaris 11.4 'Services' component must be network-reachable over HTTP; exploitation requires only that this HTTP-facing service be exposed to the attacker (AV:N, AC:L, PR:N, UI:N - no authentication, no user interaction, default-reachable configurations). The main limiting factor is network exposure: systems where the vulnerable Solaris Services HTTP interface is firewalled off or restricted to trusted management networks are not reachable by arbitrary remote attackers. Scope is unchanged (S:U), impact is confined to the Solaris host, and the outcome is a complete DOS plus read of a subset of data rather than full compromise. Exploitation is further bounded to Oracle Solaris 11.4 specifically.

This is a genuinely high-priority vulnerability by its technical profile but with important caveats on real-world urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is confirmed by Oracle and describes a remotely reachable, unauthenticated, low-complexity flaw in the Solaris 'Services' component exposed over HTTP - the most dangerous access profile. Impact is split: A:H (complete DOS) plus C:L (partial unauthorized read), with no integrity impact (I:N), yielding an 8.2 base score. However, the primary outcome is availability loss (hang/repeatable crash) rather than code execution or full data compromise, so this is a DOS-weighted issue more than a full-system takeover. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no evidence of active exploitation or in-the-wild weaponization - the risk here is latent (easy to exploit if targeted) rather than demonstrated. The CVSS network vector is consistent with the description's 'network access via HTTP,' so no signal conflict exists. Net assessment: patch promptly on internet- or network-exposed Solaris 11.4 systems given the trivial exploitability and DOS impact, but absent KEV/EPSS/POC signals this is not evidence of mass exploitation and can be prioritized below CVEs with confirmed active exploitation.

A remote, unauthenticated attacker sends crafted HTTP requests to a network-reachable Solaris 11.4 'Services' endpoint, triggering a hang or repeatable crash that produces a complete denial of service and also exposes a subset of accessible data. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are required. No public exploit code was identified in the provided intelligence, so exploitation would currently require independent research or reverse-engineering of the Oracle October 2026 CPU fix.