Oracle Solaris 11.4 Services contains a flaw that allows an attacker with low privileges who can reach the system over HTTP to trigger a crash or hang in the Solaris Services component and to read a subset of accessible data. The vulnerability is characterized by a network-based attack vector, low privilege requirements, no user interaction, and an impact that comprises confidentiality loss of limited data and availability loss through frequent crashes. The description describes the issue as “easily exploitable,” indicating no extensive prerequisites beyond network access.

Oracle Solaris 11.4 is the only version listed as affected. No other products or versions are mentioned in the advisory. The vulnerability resides in the Solaris Services component and there are no alternative workarounds provided by Oracle.

The CVSS v3.1 score of 7.1 signals a high‑severity vulnerability with significant availability impact and some confidentiality risk. Because the EPSS score is < 1 % the overall exploitation probability is very low, and the issue is not indexed in the CISA KEV catalog, empirical exploitation data is limited; however, the vector shows that network access is sufficient and no privileged escalation or user interaction is required. If Solaris servers are publicly reachable, low‑privileged attackers could frequently trigger crashes or gain limited data exposure, elevating the operational risk for organizations running unpatched 11.4 installations.