Live › vulnerability › CVE-2026-87417
Go to dashboardA flaw in the Image Packaging System component of Oracle Solaris 11.4 lets an unauthenticated remote attacker reach data over HTTP. Successful attacks can give unauthorized access to critical data on the system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running Oracle Solaris 11.4 where the Image Packaging System is reachable over HTTP. Hosts with the IPS depot service disabled or not reachable from the network are less exposed; the sources do not say which configurations are vulnerable.
No product ranges from the sources yet.
pkg info entire on the Solaris host to see the installed 11.4 releasesvc:/application/pkg/server) is enabled with svcs -a | grep pkg/serverEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-87417")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.