This vulnerability in the Oracle Solaris Image Packaging System allows an unauthenticated attacker to compromise the system over HTTP, potentially gaining unauthorized access to critical data and performing update, insert, or delete operations on Solaris‑accessible data. The flaw is an improper access control weakness (CWE‑285). The impact is a loss of confidentiality of some data and, if exploited, full control over system data, as indicated by the CVSS 3.1 score of 7.1 reflecting high confidentiality impact and medium integrity impact.

The affected product is Oracle Solaris 11.4. No other versions or additional products are listed in the supplied data.

The vulnerability is easily exploitable from the network over HTTP without privileges. Human interaction from a third party is required for a successful attack. The EPSS score of less than 1% indicates a very low but non‑zero exploitation probability, and the CVE is not listed in the CISA KEV catalog. The CVSS score of 7.1 signals a moderate to high risk, suggesting that the issue should be addressed promptly.