Technical impact
A flaw in the Oracle Solaris 11.4 filesystem component, identified as CWE‑269 (Improper Privilege Management) and CWE‑400 (Denial of Service), allows a logged‑on low‑privileged user to obtain privileged data and to trigger system hangs or crashes. The vulnerability can be exploited to read or modify critical files that should be protected by access controls, enabling a breach of confidentiality. Successful exploitation does not require network exposure and results in a loss of availability through repeated, repeatable crashes or hangs in the operating system.
Affected Systems
Oracle Solaris 11.4 deployed on infrastructure with local user access is affected. This includes all installations of the 11.4 release that have not applied the vendor patch; no other versions or product lines are known to be impacted.
Risk and Exploitability
The CVSS 3.1 base score of 7.1 indicates moderate to high risk, with a local low‑privileged attack vector, low attack complexity, and no user interaction required. The EPSS score of less than 1% implies a very low current probability of exploitation, and the vulnerability has not yet been recorded in the CISA KEV catalog. Because the attacker must already have a local logon, the attack is confined to the local environment, but once executed the impact can be severe due to the confidentiality and availability consequences it introduces.
