Oracle Solaris 11.4’s Image Packaging System contains a flaw that allows an unauthenticated attacker with network access via HTTP to read data stored on the system. The vulnerability requires no credentials or privileged access, and succeeds through simple HTTP requests to the packaging service, resulting in a confidentiality compromise with high impact. The CVSS 3.1 base score of 7.5 reflects its ease of exploitation and the severity of unauthorized data disclosure, while integrity and availability remain unaffected.

The affected vendor is Oracle Corporation and the product is Oracle Solaris 11.4, precisely its Image Packaging System component. Only version 11.4 is mentioned as vulnerable; no other versions or variants are listed in the advisory.

The CVSS score indicates moderate‑to‑high risk, and the EPSS score is not available, suggesting no current data on exploitation frequency. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation yet. However, the attack vector is clear and straightforward—network via HTTP—making it likely that an attacker could exploit the flaw from any reachable host. The combination of high confidentiality impact, no authentication requirement, and network accessibility translates to a significant risk for organizations running Oracle Solaris 11.4 and exposing the Image Packaging System to external network traffic.