---
id: "CVE-2026-87421"
kind: "vulnerability"
aliases: ["CVE-2026-87421"]
title: "Oracle Solaris: Image Packaging System flaw lets unauthenticated network attackers compromise hosts"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "network-services", "oracle-solaris", "solaris"]
not_affected_if: ["no-network-exposure"]
published_at: "2026-10-20T22:20:20+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T03:34:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87421", "first_seen_at": "2026-10-23T21:57:26+00:00"}]
---

# Oracle Solaris: Image Packaging System flaw lets unauthenticated network attackers compromise hosts

A flaw in the Image Packaging System component of Oracle Solaris 11.4 can be reached over HTTP by an unauthenticated attacker on the network. Successful exploitation can expose critical data and allow some data to be changed or deleted, and it needs a person other than the attacker to take an action.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `pkg version` or `uname -v` on Solaris hosts to see the installed 11.4 release level
- Check whether the Image Packaging System depot service (pkg.depotd) is reachable over HTTP from the network: unknown

## Fix

- Apply the Oracle Solaris 11.4 Critical Patch Update that addresses CVE-2026-87421 (patch identifier: unknown)
- Restrict network access to the Image Packaging System HTTP service until patched: unknown

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87421

## From the sources

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Solaris accessible data as well as  unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_