{"id":"CVE-2026-87417","kind":"vulnerability","aliases":["CVE-2026-87417"],"related":[],"title":"Oracle Solaris: Image Packaging System flaw exposes data over HTTP","description":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","summary":"A flaw in the Image Packaging System component of Oracle Solaris 11.4 lets an unauthenticated remote attacker reach data over HTTP. Successful attacks can give unauthorized access to critical data on the system.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","oracle","self-hosted","solaris"],"not_affected_if":["default-config"],"how_to_check":"- Run `pkg info entire` on the Solaris host to see the installed 11.4 release\n- Check whether the IPS depot service (`svc:/application/pkg/server`) is enabled with `svcs -a | grep pkg/server`","fix":"- Apply the Oracle Solaris 11.4 Image Packaging System patch from Oracle's Critical Patch Update for the relevant quarter (version unknown from sources)","status":"open","published_at":"2026-10-20T22:20:20+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:18:43+00:00","updated_at":"2026-10-25T03:18:43+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:18:43Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Solaris 11.4 Image Packaging System patch from Oracle's Critical Patch Update for the relevant quarter (version unknown from sources)","reach":"internet","title":"Oracle Solaris: Image Packaging System flaw exposes data over HTTP","impact":"high","summary":"A flaw in the Image Packaging System component of Oracle Solaris 11.4 lets an unauthenticated remote attacker reach data over HTTP. Successful attacks can give unauthorized access to critical data on the system.","category":"infrastructure","nicknames":[],"who_cares":["solaris","oracle","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated remote attacker reads critical data on the Solaris host","analyst_note":"Confirm the exact fixed patch ID and which IPS HTTP service is affected, using the Oracle Security Alert or CPU advisory for CVE-2026-87417.","how_to_check":"- Run `pkg info entire` on the Solaris host to see the installed 11.4 release\n- Check whether the IPS depot service (`svc:/application/pkg/server`) is enabled with `svcs -a | grep pkg/server`","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running Oracle Solaris 11.4 where the Image Packaging System is reachable over HTTP. Hosts with the IPS depot service disabled or not reachable from the network are less exposed; the sources do not say which configurations are vulnerable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000633,"input_tokens":3441,"output_tokens":578,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-87417':13A,16A '/av':125C '11.4':34B,76C '3.1':115C,124C '7.5':118C 'access':49B,85C,101C,107C,112C 'affect':74C 'allow':80C 'attack':39B,45B,82C,93C 'base':116C 'complet':106C 'compon':30B,65C 'compromis':89C 'confidenti':119C 'critic':51B,103C 'cve':11A,14A 'cvss':114C,121C,123C 'data':8A,41B,52B,104C,113C 'easili':77C 'exploit':78C 'expos':7A 'flaw':6A,24B 'give':47B 'h/i':131C 'host':21B 'http':10A,43B,87C 'imag':3A,27B,66C 'impact':120C 'infrastructur':17B 'l/pr':127C 'let':35B 'n':133C 'n/a':132C 'n/ac':126C 'n/s':129C 'n/ui':128C 'network':84C 'oracl':1A,18B,32B,59C,63C,90C,110C 'packag':4A,28B,67C 'product':61C 'reach':40B 'remot':38B 'result':98C 'score':117C 'self':20B 'self-host':19B 'solari':2A,22B,33B,60C,91C,111C 'success':44B,92C 'support':70C 'system':5A,29B,55B,64C,68C 'u/c':130C 'unauthent':37B,81C 'unauthor':48B,100C 'vector':122C 'version':71C 'via':86C 'vulner':56C,79C,96C","nicknames":[],"mitigations":[],"who_affected":"Systems running Oracle Solaris 11.4 where the Image Packaging System is reachable over HTTP. Hosts with the IPS depot service disabled or not reachable from the network are less exposed; the sources do not say which configurations are vulnerable.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87417","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87417","severity":null,"published_at":"2026-10-20T22:20:20+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}