CVE-2026-91254 in Solaris
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the kernel component of Oracle Solaris version 11.4, representing a critical security flaw that impacts system availability and stability. As a core operating system component, the kernel manages hardware resources and enforces security policies; therefore, vulnerabilities at this level pose significant risks to the integrity and reliability of the entire platform. The affected software is susceptible to an easily exploitable attack vector that does not require authentication or user interaction. An attacker with network access via HTTP can trigger this flaw remotely, leveraging the lack of required credentials to initiate malicious requests against the vulnerable system. This characteristic significantly lowers the barrier for entry, allowing threat actors who may have limited technical sophistication to execute successful attacks provided they possess basic network connectivity and knowledge of standard web protocols.
The primary operational impact of this vulnerability is a denial of service condition characterized by either a complete hang or frequently repeatable crashes of the Oracle Solaris operating system. Unlike vulnerabilities that lead to data exfiltration or privilege escalation, this flaw specifically targets availability, rendering the host inaccessible to legitimate users and services. The ability to cause repeated crashes suggests that an attacker can sustainably disrupt operations through persistent probing or automated scripts, leading to prolonged downtime for critical infrastructure hosted on these systems. Such instability can result in significant business disruption, loss of productivity, and potential data corruption if processes are terminated abruptly without proper cleanup mechanisms.
From a classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, or potentially CWE-20, improper input validation, depending on the specific internal mechanism that fails to handle malformed HTTP requests correctly within the kernel space. The attack technique is consistent with ATT&CK tactic T1499, Endpoint Denial of Service, specifically under subtechniques involving application exhaustion or service disruption through network-based exploitation. By targeting the availability aspect exclusively, as indicated by the high impact score on that axis in the CVSS metrics, the vulnerability serves as a potent tool for disruptive campaigns rather than espionage or lateral movement at this stage.
The Common Vulnerability Scoring System version 3.1 assigns this issue a base severity of 7.5 out of 10, classifying it as high risk. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms that the attack is network-based with low complexity and no prerequisites for authentication or user interface interaction. While confidentiality and integrity impacts are rated as none, the high availability impact underscores the critical nature of maintaining system uptime. Organizations relying on Oracle Solaris 11.4 must treat this vulnerability as a priority due to its ease of exploitation and severe operational consequences.
Mitigation strategies should focus primarily on applying vendor-provided patches or updates that address the underlying kernel flaw immediately upon release. In environments where patching is not immediately feasible, network-level controls such as web application firewalls can be configured to inspect HTTP traffic for patterns indicative of this specific exploit attempt. Additionally, restricting access to management interfaces and limiting exposure of services running on affected systems through strict firewall rules can reduce the attack surface. Regular monitoring of system logs for signs of repeated crashes or resource exhaustion events will aid in early detection of potential exploitation attempts before they result in prolonged outages.