{"id":"CVE-2026-60432","kind":"vulnerability","aliases":["CVE-2026-60432"],"related":[],"title":"Oracle Solaris: Image Packaging System flaw lets unauthenticated network attackers take over","description":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Solaris 11.3 and 11.4 have a critical flaw (CVSS 9.8) in the Image Packaging System that an unauthenticated attacker can reach over HTTP and use to take over the host. Oracle fixed it in the October 2026 Critical Patch Update. No exploitation or public PoC found.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Solaris","fixed":["11.4 SRU96 (96.227.1), unconfirmed for this CVE"],"affected":"11.3, 11.4 (before the October 2026 CPU)","ecosystem":"vendor"}],"ecosystems":[],"tags":["image-packaging-system","infrastructure","oracle-solaris","self-hosted","solaris"],"not_affected_if":["default-config","no-network-exposure"],"how_to_check":"Run 'pkg info entire' to see the installed Solaris version and SRU. 11.4 builds older than SRU96 (96.227.1) are probably exposed; confirm in MOS KB161496. Run 'svcs -a | grep pkg' to see whether pkg/server (the IPS HTTP repository) is online. Whether that service must be enabled to be exposed is not stated publicly: unknown.","fix":"On 11.4, apply the October 2026 CPU: run 'pkg update' as root against the support repository, which brings in SRU96 (96.227.1); MOS KB631614 has the download. Confirm in MOS KB161496 that SRU96 contains the fix for CVE-2026-60432. 11.3 is out of regular support: check MOS note CPU57. Until patched, restrict network access to any pkg.depotd or pkg/server HTTP service.","status":"open","published_at":"2026-10-20T22:19:31+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:34:47+00:00","updated_at":"2026-10-23T23:05:14+00:00","category":"infrastructure","confidence":0.55,"triage":{"at":"2026-10-23T22:34:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Solaris: Image Packaging System flaw lets unauthenticated network attackers take over","impact":"high","summary":"Oracle Solaris 11.3 and 11.4 contain a flaw in the Image Packaging System component that is reachable over HTTP. An unauthenticated attacker on the network can fully compromise the system.","category":"infrastructure","who_cares":["solaris","oracle-solaris","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker takes over the Solaris host with full read, write and availability impact","analyst_note":"Find Oracle's Critical Patch Update advisory and the patched Solaris 11.3 and 11.4 SRU versions, plus whether the IPS HTTP repository service must be enabled to be exposed.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000489,"input_tokens":3065,"output_tokens":364,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory and the patched Solaris 11.3 and 11.4 SRU versions, plus whether the IPS HTTP repository service must be enabled to be exposed.","search":"'-2026':13A,16A '-60432':14A,17A '/av':142C '11.3':34B,98C '11.4':36B,100C '2026':69B '3.1':129C,141C '9.8':42B,132C 'access':109C 'affect':96C 'allow':104C 'attack':10A,51B,106C,117C 'avail':136C 'base':130C 'compon':88C 'compromis':113C 'confidenti':133C 'critic':39B,70B 'cve':12A,15A 'cvss':41B,128C,138C,140C 'easili':101C 'exploit':74B,102C 'fix':64B 'flaw':6A,40B 'found':78B 'h':150C 'h/a':149C 'h/i':148C 'host':30B,62B 'http':55B,111C 'imag':3A,21B,45B,89C 'image-packaging-system':20B 'impact':137C 'infrastructur':24B 'integr':134C 'l/pr':144C 'let':7A 'n/ac':143C 'n/s':146C 'n/ui':145C 'network':9A,108C 'octob':68B 'oracl':1A,26B,32B,63B,82C,86C,114C,126C 'oracle':18A 'oracle-solari':25B 'packag':4A,22B,46B,90C 'patch':71B 'poc':77B 'product':84C 'public':76B 'reach':53B 'result':122C 'score':131C 'self':29B 'self-host':28B 'solari':2A,27B,31B,33B,83C,115C,127C 'solaris':19A 'success':116C 'support':92C 'system':5A,23B,47B,87C,91C 'take':11A,59B 'takeov':124C 'u/c':147C 'unauthent':8A,50B,105C 'updat':72B 'use':57B 'vector':139C 'version':93C 'via':110C 'vulner':79C,103C,120C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60432","severity":null,"published_at":"2026-10-20T22:19:31+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-60432:364","url":null,"severity":null,"published_at":"2026-10-23T23:05:14+00:00","modified_at":"2026-10-23T23:05:14+00:00","first_seen_at":"2026-10-23T23:05:14+00:00","fetched_at":"2026-10-23T23:05:14+00:00","note":"Oracle CPU Oct 2026 (19 Oct) lists Solaris 11.3 and 11.4; CVE record gives CVSS 9.8 AV:N/PR:N via HTTP. Oracle's public pages do not name the fixed SRU for this CVE and do not say whether the IPS HTTP repository service must be enabled. The Systems risk matrix and MOS notes were unreachable or truncated. SRU96 (96.227.1) is the October 2026 CPU for 11.4, but I could not confirm it carries this fix. No exploitation or PoC found, not in KEV, no social search done."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1770,"url":"https://blogs.oracle.com/solaris/announcing-oracle-solaris-11-4-sru96-cpu","title":"Announcing Oracle Solaris 11.4 SRU96 CPU","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1773,"url":"https://www.cve.org/CVERecord?id=CVE-2026-60432","title":"CVE Record: CVE-2026-60432","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}