---
id: "CVE-2026-60432"
kind: "vulnerability"
aliases: ["CVE-2026-60432"]
title: "Oracle Solaris: Image Packaging System flaw lets unauthenticated network attackers take over"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Oracle Solaris", "fixed": ["11.4 SRU96 (96.227.1), unconfirmed for this CVE"], "affected": "11.3, 11.4 (before the October 2026 CPU)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["image-packaging-system", "infrastructure", "oracle-solaris", "self-hosted", "solaris"]
not_affected_if: ["default-config", "no-network-exposure"]
published_at: "2026-10-20T22:19:31+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-23T23:05:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60432", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:05:14+00:00"}]
---

# Oracle Solaris: Image Packaging System flaw lets unauthenticated network attackers take over

Oracle Solaris 11.3 and 11.4 have a critical flaw (CVSS 9.8) in the Image Packaging System that an unauthenticated attacker can reach over HTTP and use to take over the host. Oracle fixed it in the October 2026 Critical Patch Update. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Solaris affected 11.3, 11.4 (before the October 2026 CPU) fixed 11.4 SRU96 (96.227.1), unconfirmed for this CVE

## How to check

Run 'pkg info entire' to see the installed Solaris version and SRU. 11.4 builds older than SRU96 (96.227.1) are probably exposed; confirm in MOS KB161496. Run 'svcs -a | grep pkg' to see whether pkg/server (the IPS HTTP repository) is online. Whether that service must be enabled to be exposed is not stated publicly: unknown.

## Fix

On 11.4, apply the October 2026 CPU: run 'pkg update' as root against the support repository, which brings in SRU96 (96.227.1); MOS KB631614 has the download. Confirm in MOS KB161496 that SRU96 contains the fix for CVE-2026-60432. 11.3 is out of regular support: check MOS note CPU57. Until patched, restrict network access to any pkg.depotd or pkg/server HTTP service.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-60432
- 2026-10-23T23:05:14+00:00 analyst — Oracle CPU Oct 2026 (19 Oct) lists Solaris 11.3 and 11.4; CVE record gives CVSS 9.8 AV:N/PR:N via HTTP. Oracle's public pages do not name the fixed SRU for this CVE and do not say whether the IPS HTTP repository service must be enabled. The Systems risk matrix and MOS notes were unreachable or truncated. SRU96 (96.227.1) is the October 2026 CPU for 11.4, but I could not confirm it carries this fix. No exploitation or PoC found, not in KEV, no social search done.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-60432 https://www.cve.org/CVERecord?id=CVE-2026-60432
- [fix] Announcing Oracle Solaris 11.4 SRU96 CPU https://blogs.oracle.com/solaris/announcing-oracle-solaris-11-4-sru96-cpu

## From the sources

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_