Oracle Solaris CVE-2026-91255

Exploitation requires network reachability to an HTTP-handling service on Oracle Solaris 11.4 that routes into the vulnerable Kernel code path; per the vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or non-default configuration is indicated, so default deployments reachable over HTTP are exposed. The principal limiting factor is impact scope: the flaw yields only denial of service (A:H, C:N/I:N) - it cannot be used for data theft or code execution - and risk is further bounded by whether the HTTP-exposed service is network-accessible to untrusted sources versus firewalled to management networks.

This is a genuine availability-only risk rather than a critical-impact flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is internally consistent with the description: an unauthenticated, low-complexity, network-reachable attack over HTTP that produces a complete denial of service (hang or repeatable crash) with no confidentiality or integrity impact. The 7.5 score is driven entirely by A:H. No EPSS score, KEV listing, POC, or SSVC decision-point data was provided, so exploitation likelihood cannot be quantified from the inputs - there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical priority is moderate: trivially exploitable pre-auth DoS against a kernel component is operationally serious for availability-sensitive Solaris hosts, but the absence of any CIA impact beyond availability and the lack of exploitation-probability signals mean this is not the top-tier emergency a code-execution flaw would be. Note the signal gap explicitly: with no EPSS and no KEV, real-world exploitation frequency is unverified and should be confirmed against Oracle's October 2026 CPU and vendor telemetry.

A remote, unauthenticated attacker with network reachability to an affected Oracle Solaris 11.4 host sends a crafted HTTP request that reaches the vulnerable kernel code path, causing the system to hang or enter a repeatable crash loop (complete DoS). No credentials or user interaction are required (PR:N/UI:N) and complexity is low (AC:L), so exploitation is reliable once the host is reachable. No public exploit code was identified in the provided data.