Oracle Solaris EUVD-2026-106259

Exploitation requires the attacker to already possess a valid low-privileged interactive logon on the host where Oracle Solaris 11.4 executes (PR:L, AV:L) - there is no remote or network-reachable path and no default-configuration exposure to unauthenticated attackers. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning once local access exists, escalation is reliable. The primary limiting factor is the prerequisite local account/foothold; the flaw is confined to Solaris 11.4 and the Services component, so hosts not running that version, or where untrusted users have no shell access, are not exposed.

The CVSS 3.1 base score of 7.8 (HIGH) is driven by a local attack vector (AV:L) with low complexity (AC:L), requiring only low privileges (PR:L) and no user interaction (UI:N), yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) and complete host takeover. Critically, the vector is LOCAL, not network - this is a privilege-escalation-class flaw requiring an attacker to already have a valid low-privileged logon on the Solaris host, which substantially tempers real-world risk compared to a remotely exploitable bug of the same score. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified; the absence of these signals is not evidence of safety but does mean there is no confirmed active exploitation. The Oracle 'Easily exploitable' phrasing aligns with AC:L but should not be read as network-reachable. Note a signal conflict: the input Tags label this 'Information Disclosure,' yet both the Oracle description and the CVSS vector indicate full C/I/A takeover - treat this as a full-compromise local privilege escalation, not merely disclosure. Overall this is a legitimate patch-priority issue for Solaris 11.4 operators but is a second-tier (post-initial-access) risk rather than an internet-facing emergency.

An attacker with an existing low-privileged shell account on a Solaris 11.4 server - obtained via stolen credentials, a compromised service account, or an insider - abuses a flaw in the Services component to escalate to full control of the operating system. No user interaction or victim is needed, and attack complexity is low (AC:L), so a reliable local exploit would run deterministically once access is obtained. No public exploit was identified at the time of analysis.