---
id: "CVE-2026-87422"
kind: "vulnerability"
aliases: ["CVE-2026-87422"]
title: "Oracle Solaris 11.4 Services flaw allows limited data changes locally"
severity: "low"
cvss: 2.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "on-prem", "oracle", "solaris"]
not_affected_if: ["no-local-logon", "not-solaris-11.4"]
published_at: "2026-10-20T22:20:20+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T04:49:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87422", "first_seen_at": "2026-10-23T21:57:26+00:00"}]
---

# Oracle Solaris 11.4 Services flaw allows limited data changes locally

A flaw in the Services component of Oracle Solaris 11.4 lets an attacker who already has a local logon modify some data the system can access. Exploitation is hard and needs a second person to take an action, per the CVSS vector (AV:L/AC:H/PR:N/UI:R, integrity impact only).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Solaris release with `pkg info entire` or `uname -v` and confirm whether it is 11.4.
- Review the Oracle Critical Patch Update advisory for the Solaris 11.4 patch level applied to the host.

## Fix

- Apply the Oracle Solaris 11.4 update that addresses CVE-2026-87422, using `pkg update` from the Oracle support repository (exact version unknown from sources).

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87422

## From the sources

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 2.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_