Oracle Solaris EUVD-2026-106257

Requires the attacker to already have a valid low-privileged interactive login on the Oracle Solaris 11.4 host (AV:L, PR:L) and to be able to reach the X Window System component locally; no user interaction by a victim is needed (UI:N). Limiting factors: exploitation is impossible without an existing local account, cannot be performed over the network, and affects only Solaris 11.4 - hosts without local attacker accounts or running other versions are not exposed. Oracle characterizes it as 'easily exploitable' once local logon is held, consistent with AC:L.

This is a moderate-severity, low-real-priority local privilege issue, not an urgent remote threat. The CVSS 3.1 base score of 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) describes a locally-exploitable flaw requiring an existing low-privileged account on the Solaris host; impact is partial across confidentiality, integrity and availability (all :L), with no scope change. All three exploitation-status signals point the same way: no CISA KEV listing, no public exploit code identified, and no EPSS score was provided in the input - so there is no evidence of active or imminent exploitation. No SSVC decision data was supplied. The one mild amplifier is Oracle's own wording ('easily exploitable'), consistent with AC:L, but local access (AV:L) plus a required login (PR:L) sharply limits reach: an unauthenticated or remote attacker cannot leverage this directly. Net: a legitimate patch-management item on the normal Oracle quarterly cadence, not an emergency. No signals conflict; the main gap is the absent EPSS value and CWE (listed N/A), which prevents a quantitative probability estimate.

A user who already holds a low-privileged local account on an Oracle Solaris 11.4 system interacts with the vulnerable X Window System component to gain unauthorized partial read and write/delete access to some Solaris-accessible data and to trigger a partial denial of service. No public proof-of-concept or exploit code has been identified, and the attack cannot be launched remotely or without a valid login. Realistically this is a post-authentication escalation/abuse step rather than an initial-access vector.