CVE-2026-87413 in Solaris
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Filesystems component of Oracle Solaris version 11.4, representing a significant availability risk for systems relying on this operating environment. The core technical flaw allows an attacker with low privileges and valid logon credentials to trigger conditions that lead to system instability. Specifically, the defect enables unauthorized entities to cause hangs or frequent, repeatable crashes resulting in complete denial of service. This indicates that the underlying code handling filesystem operations lacks sufficient robustness against malformed inputs or specific state transitions initiated by authenticated users, leading to resource exhaustion or kernel-level failures rather than data corruption or privilege escalation.
From a threat modeling perspective, this vulnerability aligns with CWE-400, which covers uncontrolled resource consumption, and potentially CWE-269 regarding improper authorization if the boundary between low-privileged user actions and system-critical filesystem operations is not strictly enforced in terms of input validation. The attack vector requires local access, meaning an attacker must already have a foothold on the infrastructure where Oracle Solaris executes. This classification places it within the ATT&CK framework under techniques related to resource hijacking or denial of service via local execution, such as T1499 Endpoint Denial of Service if viewed through the lens of impact, though the primary mechanism is likely rooted in improper input handling leading to system crashes.
The operational impact of this vulnerability is severe due to its effect on availability. A successful exploit results in a complete denial of service, rendering the Oracle Solaris instance unresponsive or requiring a hard reboot. For production environments running critical workloads, such instability can lead to significant downtime and loss of productivity. Since the attack requires low-privileged access, it highlights a risk where compromised user accounts or insider threats with minimal permissions can disrupt system operations without needing elevated privileges initially. This underscores the importance of strict privilege separation and monitoring for anomalous behavior in filesystem interactions even from standard user contexts.
Mitigation strategies should focus on applying the latest security patches provided by Oracle Systems to address the specific flaw within the Filesystems component. Administrators must ensure that Oracle Solaris 11.4 is updated to a version where this vulnerability has been remediated. Additionally, implementing strict access controls and monitoring for unusual filesystem activity can help detect potential exploitation attempts early. Regular audits of user privileges are recommended to minimize the attack surface available to low-privileged accounts, ensuring that even if an attacker gains initial logon credentials, their ability to impact system stability is minimized through principle of least privilege enforcement.