Description
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A flaw in Oracle Solaris’s Image Packaging System permits an unauthenticated attacker to gain full control over the system through the HTTP interface. The vulnerability is easily exploitable, and a successful attack results in complete compromise, affecting confidentiality, integrity, and availability.

Affected Systems

Oracle Corporation’s Solaris operating system, versions 11.3 and 11.4, are affected. The Image Packaging System component is the entry point for the exploit.

Risk and Exploitability

The CVSS 3.1 base score of 9.8 indicates a critical impact. The EPSS score of 0.00486 (i.e., less than 1%) indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw over the network via HTTP, requiring no prior access or privileges.

Generated by OpenCVE AI on October 22, 2026 at 11:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle Solaris security update for versions 11.3 and 11.4 as announced in the October 2026 advisory.
  • If a patch cannot be applied immediately, block or disable the HTTP interface used by the Image Packaging System through firewall rules or service configuration.
  • Implement network segmentation or strict access controls to limit which hosts can reach the affected servers, thereby reducing the risk of exploitation.

Generated by OpenCVE AI on October 22, 2026 at 11:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 21:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*
cpe:2.3:o:oracle:solaris:11.4:*:*:*:*:*:*:*

Thu, 22 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Oracle Solaris Image Packaging System Remote Code Execution Vulnerability
Weaknesses CWE-284

Wed, 21 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Title Oracle Solaris Image Packaging System Remote Code Execution Vulnerability
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle solaris
CPEs cpe:2.3:a:oracle:solaris:11.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:solaris:11.4:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle solaris
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Solaris
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T10:55:19.187Z

Reserved: 2026-07-08T15:51:40.536Z

Link: CVE-2026-60432

cve-icon Vulnrichment

Updated: 2026-10-21T10:54:59.220Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:19:31.283

Modified: 2026-11-09T21:35:31.720

Link: CVE-2026-60432

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T18:15:11Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function