Oracle Solaris EUVD-2026-106255

Exploitation requires network reachability to the Oracle Solaris 'Utility' component over HTTP plus a low-privilege authenticated foothold on the system (CVSS PR:L) - it is NOT exploitable by a fully unauthenticated remote attacker against a default install. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once a low-privilege account and HTTP access to the component exist, exploitation is straightforward. Limiting factors: the attacker must already possess or acquire valid low-level credentials, the system must be running Solaris 11.3 or 11.4 with the HTTP-exposed Utility component reachable, and network segmentation restricting access to that component would meaningfully reduce exposure.

This is a genuine priority for any Oracle Solaris 11.3/11.4 operator. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes an easily exploitable network flaw requiring only low-level privileges and no user interaction, and Oracle's own description states successful attacks result in full 'takeover' of the host - consistent with the C:H/I:H/A:H impact triad. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so the raw exploitation-likelihood signals are absent; this is 'no public exploit identified at time of analysis' rather than evidence of low real-world interest. A notable conflict exists between the metadata and the impact: the tag labels this 'Information Disclosure', yet both the CVSS vector and the description indicate full confidentiality, integrity, and availability compromise (complete takeover), so the tag materially understates the severity and should not be relied upon for triage. Because exploitation needs a low-privilege foothold (PR:L), realistic risk is highest where untrusted or semi-trusted users already hold network-reachable accounts; it is not a zero-interaction, fully unauthenticated internet worm scenario, but the low complexity and lack of UI make it readily weaponizable once an account exists.

An attacker holding a low-privilege account (or who has phished/obtained one) sends a crafted HTTP request to the vulnerable Utility component of an internet- or network-reachable Oracle Solaris 11.3/11.4 system. Because attack complexity is low and no user interaction is needed, the request triggers the flaw and yields full compromise of the host. No public proof-of-concept was identified in the provided data, so exploitation currently requires independent development.