CVE-2026-87411 in Solaris
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Filesystems component of Oracle Solaris version 11.4, representing a significant availability risk for systems relying on this operating environment. The core technical flaw allows an attacker with low privileges and valid logon credentials to trigger conditions that lead to system instability. Specifically, the defect enables unauthorized entities to cause the operating system to hang or experience frequent, repeatable crashes resulting in complete denial of service. This indicates a failure in resource management or state handling within the filesystem subsystem when processing specific inputs from authenticated users, leading to unrecoverable states for the kernel or critical services.
From an operational perspective, this vulnerability poses a severe threat to system availability and continuity. Since exploitation requires only low-privileged access with logon capabilities, it is relatively easy for malicious insiders or attackers who have gained initial foothold through phishing or credential theft to escalate their impact from mere data exposure to total service disruption. The ability to cause complete denial of service means that critical business applications hosted on Oracle Solaris can be rendered inaccessible without warning, leading to significant downtime and potential financial loss. Unlike vulnerabilities affecting confidentiality or integrity, this issue directly undermines the reliability and uptime guarantees essential for enterprise infrastructure.
The technical classification aligns with CWE-400, which covers uncontrolled resource consumption, as well as CWE-789, relating to memory corruption issues that may lead to crashes depending on the specific implementation details of the filesystem driver or kernel module involved. In terms of adversary behavior, this vulnerability maps to MITRE ATT&CK technique T1529, System Shutdown/Reboot, where an attacker disrupts availability by crashing services or shutting down systems. It also reflects aspects of privilege escalation paths in broader attack chains, as a denial-of-service event can be used as a distraction for other malicious activities or to force system reboots that might bypass certain security controls during startup sequences.
Mitigation strategies should prioritize immediate patching through Oracle’s latest errata updates which address the filesystem component defects. Organizations must ensure their update management processes are agile enough to deploy these patches promptly, given the low barrier to exploitation for authenticated users. In addition to patching, implementing strict access control policies and monitoring for unusual system behavior or repeated crash logs can help detect potential exploitation attempts early. Network segmentation should be reviewed to limit lateral movement opportunities, ensuring that even if an attacker gains low-privileged access, their ability to reach the vulnerable filesystem components is restricted by default-deny firewall rules and least privilege principles applied across the infrastructure.