EUVD-2026-106509
GHSA-h57x-8fh7-4844
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Solaris host over HTTP
-
ExploitSend crafted HTTP request
-
ExecutionTrigger kernel fault
-
ImpactSystem hang or crash (complete DOS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected Oracle Solaris 11.4 system must expose a network-reachable HTTP-handling path into the vulnerable Kernel component; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity against default configurations. The practical limiting factor is network exposure: systems where the vulnerable HTTP interface is not reachable from untrusted networks (e.g. firewalled, internal-only, or not running the affected service) are not exposable. Impact is confined to availability - a hang or repeatable full crash - with no path to data disclosure, modification, or code execution. |
| Impact | This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an easily exploitable, remotely reachable, unauthenticated flaw requiring no user interaction, which justifies the 7.5 base score - but the impact is strictly availability (C:N/I:N/A:H), so it cannot be used to read data, escalate privileges, or execute code. It is a complete-DoS (hang or repeatable crash) only. No EPSS score, CISA KEV listing, public POC, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified; the only exploitation-maturity signal available is Oracle's own description of 'easily exploitable.' Treating this as a priority is justified where Solaris 11.4 is internet- or network-reachable over HTTP, but it ranks below any concurrent flaw affecting confidentiality or integrity. No signals conflict with the vector; the main gap is the absence of exploitation-probability and patch-confirmation data beyond the Oracle CPU reference. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a network-reachable Oracle Solaris 11.4 system, triggering a flaw in the Kernel component that causes the host to hang or crash. Because the condition is 'frequently repeatable,' the attacker can re-send the trigger to keep the system offline, producing a sustained denial of service. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Unauthenticated network attackers can cause a hang or frequently repeatable crash of Oracle Solaris 11.4 by reaching the Kernel component through an HTTP-exposed path, producing a complete denial of service with no confidentiality or integrity impact. The CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code or CISA KEV entry was identified at time of analysis. Practical exposure is limited to systems where the vulnerable HTTP-handling path is reachable from untrusted networks.
RemediationAI
Use Oracle's October 2026 Critical Patch Update at https://www.oracle.com/security-alerts/cpuoct2026.html as the authoritative remediation source and apply the Solaris 11.4 update it identifies; the supplied data does not include an exact fixed version, so confirm the minimum patched revision in the advisory. Until patched, block untrusted network access to the affected HTTP-handling path at the perimeter and host firewall, and disable any HTTP-exposed service that is not operationally required, accepting the loss of that management or application access as the trade-off. Network segmentation and internal-only exposure reduce the attack surface but do not fix the kernel defect, and monitoring for repeated hangs or crashes with failover or restart is only a temporary availability control that accepts recurring downtime risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Solaris is a Unix operating system, and this issue is located in its Kernel component with an HTTP-based network attack path, according to Oracle's advisory. The CVSS vector confirms network reachability, low attack complexity, no privileges required, and no user interaction, so the vulnerability is unauthenticated from the perspective of the assessed vector. The impact is availability-only (C:N/I:N/A:H), meaning successful exploitation can hang or repeatedly crash the system but does not provide data disclosure, data modification, or code execution. No CWE is assigned in the supplied data, so the specific kernel defect class cannot be confirmed beyond the denial-of-service outcome. CPE data was not supplied, so exact platform and architecture scoping cannot be derived from the input; EUVD lists Oracle Solaris 11.4 as the affected version.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated HTTP trigger with no user interaction gives AV:N/AC:L/PR:N/UI:N; impact is complete DoS only, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Executive ViewAI
Oracle Solaris 11.4 contains a remotely triggerable flaw in its kernel that lets any unauthenticated network user force a hang or repeated crash of the operating system, removing availability of whatever runs on that host. Because the attack needs no credentials or user interaction, any Solaris 11.4 system with the affected HTTP-handling path exposed beyond a trusted network segment is a candidate target, and a successful hit takes the whole host down rather than a single application. Leadership should care because these platforms typically underpin high-value, hard-to-replace workloads where unplanned outages translate directly into service disruption and recovery cost, even though no data exposure or tampering is possible. No vendor patch and no public exploit code were identified at time of analysis, so the exposure window is governed by how quickly network reachability can be reduced.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or firewall off untrusted network reachability to the kernel HTTP-handling path, restrict access to trusted management networks via segmentation and ACLs, front-end with a proxy enforcing rate limits and connection caps, monitor for unexpected hangs and repeat crashes with alerting, and open an Oracle support case for interim fixes and patch timing.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB