Live › vulnerability › CVE-2026-87421
Go to dashboardA flaw in the Image Packaging System component of Oracle Solaris 11.4 can be reached over HTTP by an unauthenticated attacker on the network. Successful exploitation can expose critical data and allow some data to be changed or deleted, and it needs a person other than the attacker to take an action.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running Oracle Solaris 11.4 with the Image Packaging System exposed to the network over HTTP are the ones to look at. Hosts where the package service is not reachable from untrusted networks are less exposed; the sources do not describe the exact default configuration.
No product ranges from the sources yet.
pkg version or uname -v on Solaris hosts to see the installed 11.4 release levelEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Solaris accessible data as well as unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-87421")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.