Oracle Solaris 11.4 Services contains a vulnerability that allows an unauthenticated attacker with network access via HTTP to cause system crashes and to read a subset of accessible data. The CVSS 3.1 base score of 8.2 indicates that availability is severely impacted and confidentiality is moderately impacted, with the attack requiring only network connectivity and no authentication.

Vendor: Oracle Corporation, Product: Oracle Solaris, Component: Services, Affected Version: 11.4. No other versions or products are listed as impacted.

The CVSS score of 8.2 underscores a high severity risk. The EPSS score is not available, and the vulnerability is not yet listed in CISA KEV, but the lack of authentication requirements and the network‑based HTTP attack vector make exploitation highly feasible for remote adversaries. An attacker could routinely trigger full denial of service or selectively read data without credentials, which could disrupt critical operations and expose sensitive information.