EUVD-2026-37287Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Network-reachable RAD HTTPS endpoint, no auth or interaction required, privileged daemon yields scope change with full confidentiality and integrity loss; description explicitly states no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data as well as unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
AnalysisAI
Unauthenticated remote compromise of Oracle Solaris 11.4 Remote Administration Daemon (RAD) allows network attackers to read, modify, create, or delete critical data with scope change impacting adjacent products. The CVSS 3.1 base score of 10.0 with AV:N/AC:L/PR:N/UI:N reflects trivial network exploitability over HTTPS without authentication, and no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires only network reachability to the Oracle Solaris 11.4 Remote Administration Daemon's HTTPS transport (typically svc:/system/rad:remote on TCP/6788) - no credentials, no user interaction, no special client configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to maximum urgency: CVSS 3.1 base score is 10.0 with AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction), and S:C (scope change) - the highest-severity profile possible short of full availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on a network path to a Solaris 11.4 host's RAD HTTPS port sends a crafted request that bypasses authentication and invokes privileged RAD administrative methods, allowing them to read or modify any data accessible to the daemon - including system configuration, user accounts, and service definitions. Because of the scope change, the same primitive can be leveraged to pivot into other Solaris-managed subsystems (zones, SMF services, kernel parameters) without further authentication. … |
| Remediation | Apply the Oracle Critical Patch Update for June 2026 to Solaris 11.4 systems as the primary fix, following the patch matrix published at https://www.oracle.com/security-alerts/cspujun2026.html (Patch available per vendor advisory; no specific fix-version string was supplied in the input). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Isolate affected Solaris 11.4 systems from untrusted networks; disable RAD service if operationally feasible and document dependencies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Oracle Solaris
View allSame weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today