The CVE affects the kernel component of Oracle Solaris 11 and permits unauthenticated attackers with TCP network access to read a subset of data that the operating system exposes. The flaw arises from missing confidentiality controls, enabling an adversary to obtain sensitive information without user interaction. The disclosed data could include system configuration or confidential files, impacting confidentiality while leaving integrity and availability unaffected.

Affected product: Oracle Solaris 11 from Oracle Corporation. The vulnerability is present in the supported version 11 and is not limited to any subversion numbers indicated in the advisory.

CVSS 3.1 Base Score of 5.3 indicates moderate severity with a confidentiality impact. EPSS is reported as less than 1%, suggesting a low but nonzero probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network-based TCP connection to a service that interfaces with the kernel, and the exploitation does not require any special privileges or user interaction, making it relatively easy for an attacker to achieve the intended data read if the system is reachable over the network.