CVE-2026-87421
HighCVSS 7.1Summary
Vulnerability in Oracle Solaris (Image Packaging System component) affecting version 11.4. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to gain unauthorized access to and modify critical data, requiring user interaction.
Risk Assessment
An attacker could access and modify Oracle Solaris data, compromising confidentiality and integrity. The CVSS score of 7.1 indicates high risk, especially since only user interaction is required.
Recommendation
Apply Oracle security updates for Oracle Solaris 11.4. Restrict network access to the Image Packaging System and educate users about the risks of interacting with untrusted content.
Other vulnerabilities in Oracle Solaris
See all- CVE-2026-91537High
Vulnerability in Oracle Solaris (version 11.4) allows a low-privileged attacker with logon to the infrastructure to take over the system. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91348High
Vulnerability in Oracle Solaris (component Utility) versions 11.3 and 11.4. An easily exploitable local attack allows an unauthenticated attacker with logon to the infrastructure to take over the system.
- CVE-2026-91256High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services) affecting version 11.4. A low privileged attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS) and unauthorized read access to a subset of data.
- CVE-2026-91255High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel) affecting version 11.4. An unauthenticated attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-91254High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel) affecting version 11.4. An unauthenticated attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-91253High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel) affecting version 11.4. A low privileged attacker with local logon to the infrastructure can exploit it to take over Oracle Solaris.
- CVE-2026-91252High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services) affecting version 11.4. An unauthenticated attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS) and unauthorized read access to a subset of data.
- CVE-2026-91242High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugins) affecting version 11.4. A high privileged attacker with local logon can exploit it with human interaction to gain unauthorized creation, deletion or modification access to critical data and complete access to all accessible data, with scope change impacting additional products.
- CVE-2026-87417High
Vulnerability in Oracle Solaris (Image Packaging System component) affecting version 11.4. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to gain unauthorized access to critical data.
- CVE-2026-60662High
Vulnerability in the Oracle Solaris product (component: Services) affecting version 11.4. An easily exploitable flaw allows a low-privileged attacker with logon access to the infrastructure to compromise Oracle Solaris.
Original NVD description (English source)
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Solaris accessible data as well as unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS