Description
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (system crash)
Action: Patch
AI Analysis

Impact

A low‑privileged local user can exploit a flaw in the filesystem component of Oracle Solaris 11.4 that causes the operating system to hang or crash. This denial‑of‑service attack does not compromise confidentiality or integrity; its only effect is availability disruption. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects a simple, local attack that requires no user interaction and results in a full system failure.

Affected Systems

Oracle Solaris 11.4 is the only version enumerated in the advisory. No other releases are affected according to the supplied CNAs and CPE data.

Risk and Exploitability

The base CVSS score of 5.5 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that public exploits are not yet known. The local, low‑privilege attack vector means any user with logon access could trigger the crash, making the risk significant in environments where privileged accounts are not strictly controlled.

Generated by OpenCVE AI on October 21, 2026 at 14:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Oracle’s security advisories and apply any available patch or update for Solaris 11.4 that addresses the filesystem denial‑of‑service flaw.
  • Limit local logon to only essential users and enforce the principle of least privilege to reduce the number of accounts that could trigger the crash.
  • Implement monitoring to detect unexpected kernel crashes or hangs and have a rapid re‑boot or recovery plan in place to restore services.

Generated by OpenCVE AI on October 21, 2026 at 14:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 21:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:oracle:solaris:11.4:*:*:*:*:*:*:*

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Local Filesystem Denial-of-Service in Oracle Solaris 11.4
Weaknesses CWE-119
CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle solaris
CPEs cpe:2.3:a:oracle:solaris:11.4:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle solaris
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Solaris
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T14:04:15.765Z

Reserved: 2026-09-08T21:49:12.417Z

Link: CVE-2026-87411

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:19.477

Modified: 2026-11-09T21:34:11.653

Link: CVE-2026-87411

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T23:30:16Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-400

    Uncontrolled Resource Consumption