A flaw in the Image Packaging System component of Oracle Solaris 11.4 allows an unauthenticated attacker with TLS network access to perform unauthorized updates, inserts, or deletions of data managed by the system. The vulnerability is rooted in a flaw in the software’s logic flow (CWE-345), which grants the attacker the ability to alter data integrity without compromising confidentiality or availability.

Oracle Solaris 11.4, specifically the Image Packaging System service. No other product versions or components are listed as affected in the available data.

The CVSS base score of 3.1 indicates a low severity issue limited to integrity impact, and the EPSS score of < 1% shows an extremely small probability of exploitation. The vulnerability is not catalogued in the CISA KEV database. The likely attack vector is unauthenticated TLS access to the Image Packaging System, with the requirement of a human actor to interact with the system, making automated exploitation unlikely and overall risk moderate to low.