CVE-2026-91244 in Solaris
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 4.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Services component of Oracle Solaris version 11.4, representing a significant availability risk for systems relying on this operating environment. The core technical flaw is characterized by its difficulty to exploit and the requirement for local access with low privileges. This specific configuration indicates that an attacker must first gain authenticated logon access to the infrastructure where Oracle Solaris is executing before they can attempt to trigger the vulnerability. Once such access is established, the flawed logic within the services layer allows a user with minimal permissions to induce a state of instability in the operating system kernel or critical service processes. The nature of this flaw leads directly to complete denial of service conditions, manifesting as either a permanent hang where the system becomes unresponsive or a frequently repeatable crash that forces a reboot cycle. This behavior aligns closely with CWE-400, which describes resources not being properly controlled regarding their lifetime, and CWE-787, involving out-of-bounds writes in certain contexts that lead to memory corruption and subsequent crashes.
From an operational perspective, the impact of this vulnerability is severe due to its effect on system availability. A successful exploitation results in a complete denial of service, meaning that critical business operations dependent on the Oracle Solaris infrastructure are halted until manual intervention or automatic recovery mechanisms restore functionality. The CVSS 3.1 base score of 4.7 reflects an average severity level primarily driven by high impact on availability despite low attack complexity requirements for privilege escalation and no requirement for user interaction. However, the high access complexity factor suggests that while the vulnerability is exploitable, it requires specific conditions or timing to trigger successfully, which may mitigate immediate widespread exploitation risks but does not eliminate them entirely. The vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H confirms that confidentiality and integrity remain unaffected, isolating the threat strictly to availability disruptions.
In terms of attack classification, this vulnerability maps to MITRE ATT&CK techniques related to resource exhaustion or denial of service via local execution. Specifically, it falls under tactics involving impact where an adversary seeks to disrupt services rather than steal data or modify configurations. The requirement for low privileged access means that attackers often leverage previously compromised accounts with minimal permissions, such as standard user accounts on shared development servers or public-facing systems with weak account policies, to execute the exploit code. This highlights a critical gap in defense-in-depth strategies where local privilege boundaries are not sufficiently enforced against service-level bugs.
To mitigate this vulnerability, organizations should prioritize applying the latest security patches provided by Oracle for Solaris 11.4 as soon as they become available through official support channels. In environments where immediate patching is not feasible due to operational constraints, implementing strict access controls and monitoring for unusual system behavior can help detect potential exploitation attempts. It is advisable to restrict local login privileges to only those users who absolutely require them, thereby reducing the attack surface for low-privileged attackers. Additionally, deploying intrusion detection systems that monitor for patterns indicative of service crashes or hangs can provide early warning signs of an active exploit attempt. Regular audits of user permissions and adherence to the principle of least privilege are essential preventive measures against this type of local denial-of-service vulnerability.