{"id":"CVE-2026-87411","kind":"vulnerability","aliases":["CVE-2026-87411"],"related":[],"title":"Oracle Solaris 11.4: local user can crash the Filesystems component","description":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","summary":"A local user with low privileges on a Solaris 11.4 system can trigger a hang or repeatable crash of the Filesystems component. The impact is denial of service only; the CVSS vector shows no confidentiality or integrity loss.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","on-prem","oracle","shared-hosts","solaris"],"not_affected_if":["no-local-logins","other-os"],"how_to_check":"- Run `uname -v` and `pkg info entire` to confirm the Solaris 11.4 release and patch level\n- Check whether the host is listed in Oracle's July 2026 Critical Patch Update advisory for Solaris (unknown if the sources give the exact patch IDs)","fix":"- Apply the Oracle Solaris 11.4 Critical Patch Update that addresses CVE-2026-87411 (exact patch version: unknown)\n- Update with `pkg update` once the fixed SRU is available (version: unknown)","status":"open","published_at":"2026-10-20T22:20:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:12:11+00:00","updated_at":"2026-10-25T04:12:11+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:12:11Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Solaris 11.4 Critical Patch Update that addresses CVE-2026-87411 (exact patch version: unknown)\n- Update with `pkg update` once the fixed SRU is available (version: unknown)","reach":"local","title":"Oracle Solaris 11.4: local user can crash the Filesystems component","impact":"low","summary":"A local user with low privileges on a Solaris 11.4 system can trigger a hang or repeatable crash of the Filesystems component. The impact is denial of service only; the CVSS vector shows no confidentiality or integrity loss.","category":"infrastructure","nicknames":[],"who_cares":["solaris","oracle","on-prem","shared-hosts"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user crashes or hangs the Solaris host repeatedly","analyst_note":"","how_to_check":"- Run `uname -v` and `pkg info entire` to confirm the Solaris 11.4 release and patch level\n- Check whether the host is listed in Oracle's July 2026 Critical Patch Update advisory for Solaris (unknown if the sources give the exact patch IDs)","needs_analyst":false,"not_affected_if":["no-local-logins","other-os"],"who_is_affected":"Oracle Solaris 11.4 hosts where untrusted local users hold logon accounts. Systems with only trusted administrators logging in face less practical risk. The sources do not describe any remote or network-only trigger.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000624,"input_tokens":3456,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-87411':13A,16A '/av':137C '11.4':3A,35B,82C '3.1':127C,136C '5.5':130C 'abil':112C 'affect':80C 'allow':86C 'attack':89C,104C 'avail':131C 'base':128C 'caus':114C 'complet':121C 'compon':10A,47B,73C 'compromis':100C 'confidenti':60B 'crash':7A,43B,120C 'cve':11A,14A 'cvss':56B,126C,133C,135C 'denial':51B 'dos':122C 'easili':83C 'execut':98C 'exploit':84C 'filesystem':9A,46B,74C 'frequent':118C 'h':145C 'hang':40B,116C 'host':24B 'impact':49B,132C 'infrastructur':17B,94C 'integr':62B 'l/ac':138C 'l/pr':139C 'l/ui':140C 'local':4A,27B 'logon':91C 'loss':63B 'low':30B,87C 'n/a':144C 'n/i':143C 'n/s':141C 'on-prem':18B 'oracl':1A,21B,67C,71C,96C,101C,124C 'prem':20B 'privileg':31B,88C 'product':69C 'repeat':42B,119C 'result':109C 'score':129C 'servic':53B 'share':23B 'shared-host':22B 'show':58B 'solari':2A,25B,34B,68C,97C,102C,125C 'success':103C 'support':76C 'system':36B,72C 'trigger':38B 'u/c':142C 'unauthor':111C 'user':5A,28B 'vector':57B,134C 'version':77C 'vulner':64C,85C,107C","nicknames":[],"mitigations":[],"who_affected":"Oracle Solaris 11.4 hosts where untrusted local users hold logon accounts. Systems with only trusted administrators logging in face less practical risk. The sources do not describe any remote or network-only trigger.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87411","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87411","severity":null,"published_at":"2026-10-20T22:20:19+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}