Oracle Solaris CVE-2026-91256

Requires a valid low-privileged account on the target (CVSS PR:L) with network reachability to the affected Oracle Solaris 11.4 'Services' component over HTTP; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: exploitation is impossible without authentication, so risk concentrates in environments where low-level Solaris accounts are widely provisioned or where the HTTP Services endpoint is exposed to untrusted or multi-tenant networks. Oracle does not publish the exact triggering configuration, so the specific Services feature required cannot be named from available data; only version 11.4 is listed as affected.

This is a moderate-priority vulnerability rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, base 7.1) indicates network-reachable, low-complexity exploitation over HTTP, but it requires an already-authenticated low-privileged account (PR:L), which materially narrows the attacker population versus a fully unauthenticated flaw. The dominant impact is availability (A:H - complete DOS via hang or repeatable crash) with only a limited confidentiality leak (C:L) and no integrity impact (I:N), so the practical outcome is service disruption plus partial information disclosure, not full compromise. No EPSS score, CISA KEV listing, SSVC decision data, or POC was provided in the input, so there is no signal of active or probable exploitation - treat exploitation likelihood as unquantified rather than low. The AV:N/HTTP vector is consistent with the description ('network access via HTTP'), so no signal conflict is present; the main limiting factor is the PR:L authentication requirement. Overall: patch in the normal Oracle CPU cycle, prioritizing internet- or multi-tenant-exposed Solaris 11.4 Services endpoints where low-privileged access is broadly available.

A low-privileged user who can already authenticate to an exposed Oracle Solaris 11.4 Services (HTTP) endpoint sends crafted requests that trigger a hang or repeatable crash, producing a complete denial of service and leaking a subset of accessible data. Exploitation is low-complexity per CVSS (AC:L) but gated behind valid low-level credentials (PR:L); no public exploit was identified at time of analysis.