---
id: "CVE-2026-87417"
kind: "vulnerability"
aliases: ["CVE-2026-87417"]
title: "Oracle Solaris: Image Packaging System flaw exposes data over HTTP"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "oracle", "self-hosted", "solaris"]
not_affected_if: ["default-config"]
published_at: "2026-10-20T22:20:20+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:18:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87417", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle Solaris: Image Packaging System flaw exposes data over HTTP

A flaw in the Image Packaging System component of Oracle Solaris 11.4 lets an unauthenticated remote attacker reach data over HTTP. Successful attacks can give unauthorized access to critical data on the system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `pkg info entire` on the Solaris host to see the installed 11.4 release
- Check whether the IPS depot service (`svc:/application/pkg/server`) is enabled with `svcs -a | grep pkg/server`

## Fix

- Apply the Oracle Solaris 11.4 Image Packaging System patch from Oracle's Critical Patch Update for the relevant quarter (version unknown from sources)

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87417

## From the sources

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_