{"id":"CVE-2026-87422","kind":"vulnerability","aliases":["CVE-2026-87422"],"related":[],"title":"Oracle Solaris 11.4 Services flaw allows limited data changes locally","description":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 2.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).","summary":"A flaw in the Services component of Oracle Solaris 11.4 lets an attacker who already has a local logon modify some data the system can access. Exploitation is hard and needs a second person to take an action, per the CVSS vector (AV:L/AC:H/PR:N/UI:R, integrity impact only).","severity":"low","cvss":2.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","on-prem","oracle","solaris"],"not_affected_if":["no-local-logon","not-solaris-11.4"],"how_to_check":"- Check the installed Solaris release with `pkg info entire` or `uname -v` and confirm whether it is 11.4.\n- Review the Oracle Critical Patch Update advisory for the Solaris 11.4 patch level applied to the host.","fix":"- Apply the Oracle Solaris 11.4 update that addresses CVE-2026-87422, using `pkg update` from the Oracle support repository (exact version unknown from sources).","status":"open","published_at":"2026-10-20T22:20:20+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:49:30+00:00","updated_at":"2026-10-25T04:49:30+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:49:30Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Solaris 11.4 update that addresses CVE-2026-87422, using `pkg update` from the Oracle support repository (exact version unknown from sources).","reach":"local","title":"Oracle Solaris 11.4 Services flaw allows limited data changes locally","impact":"low","summary":"A flaw in the Services component of Oracle Solaris 11.4 lets an attacker who already has a local logon modify some data the system can access. Exploitation is hard and needs a second person to take an action, per the CVSS vector (AV:L/AC:H/PR:N/UI:R, integrity impact only).","category":"infrastructure","nicknames":[],"who_cares":["solaris","oracle","on-prem"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with local logon alters some accessible data","analyst_note":"","how_to_check":"- Check the installed Solaris release with `pkg info entire` or `uname -v` and confirm whether it is 11.4.\n- Review the Oracle Critical Patch Update advisory for the Solaris 11.4 patch level applied to the host.","needs_analyst":false,"not_affected_if":["not-solaris-11.4","no-local-logon"],"who_is_affected":"Systems running Oracle Solaris 11.4 where local users can log on. The sources do not describe a remote or default-exposed attack path. Hosts that run only other operating systems are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000614,"input_tokens":3464,"output_tokens":535,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-87422':13A,16A '/av':155C '11.4':3A,32B,90C '2.5':148C '3.1':145C,154C 'access':48B,136C,142C 'action':60B 'affect':88C 'allow':6A,95C 'alreadi':37B 'attack':35B,97C,112C,122C,124C 'av':65B 'base':146C 'chang':9A 'compon':28B,81C 'compromis':108C 'cve':11A,14A 'cvss':63B,144C,151C,153C 'data':8A,44B,143C 'delet':135C 'difficult':91C 'execut':106C 'exploit':49B,93C 'flaw':5A,24B 'h/pr':67B,157C 'hard':51B 'human':114C 'impact':71B,150C 'infrastructur':17B,102C 'insert':133C 'integr':70B,149C 'interact':115C 'l/a':162C 'l/ac':66B,156C 'let':33B 'limit':7A 'local':10A,40B 'logon':41B,99C 'modifi':42B 'n':163C 'n/i':161C 'n/ui':68B,158C 'need':53B 'on-prem':18B 'oracl':1A,21B,30B,75C,79C,104C,109C,140C 'per':61B 'person':56B,118C 'prem':20B 'product':77C 'r':69B 'r/s':159C 'requir':113C 'result':129C 'score':147C 'second':55B 'servic':4A,27B,82C 'solari':2A,22B,31B,76C,105C,110C,141C 'success':111C,123C 'support':84C 'system':46B,80C 'take':58B 'u/c':160C 'unauthent':96C 'unauthor':131C 'updat':132C 'vector':64B,152C 'version':85C 'vulner':72C,94C,127C","nicknames":[],"mitigations":[],"who_affected":"Systems running Oracle Solaris 11.4 where local users can log on. The sources do not describe a remote or default-exposed attack path. Hosts that run only other operating systems are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87422","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87422","severity":null,"published_at":"2026-10-20T22:20:20+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}