Live › vulnerability › CVE-2026-87414
Go to dashboardThe Image Packaging System component of Oracle Solaris 11.4 has a flaw that a network attacker can trigger over TLS, but it is hard to exploit and needs a person to take an action. A successful attack can modify or delete some data Solaris can access, with no confidentiality or availability impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running Oracle Solaris 11.4 that use the Image Packaging System (pkg) to fetch and install packages over TLS. The sources do not describe which configurations are exposed beyond that, so exposure is unknown. Hosts that do not use Solaris 11.4 or do not use IPS over the network are unlikely to be affected.
No product ranges from the sources yet.
pkg info entire on a Solaris 11.4 host to see the installed version of the entire package grouppkg update -n to see whether updates are pendingEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-87414")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.