{"id":"CVE-2026-91252","kind":"vulnerability","aliases":["CVE-2026-91252"],"related":[],"title":"Oracle Solaris Services: unauthenticated HTTP request crashes or reads data","description":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris and  unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).","summary":"An unauthenticated remote attacker sending HTTP requests to Oracle Solaris 11.4 can cause a hang or repeatable crash of the system. The same flaw also allows read access to a subset of data the system holds.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","oracle","self-hosted","solaris"],"not_affected_if":["no-network-http-services"],"how_to_check":"- Check the Solaris release with `uname -v` and `pkg info entire` on Oracle Solaris 11.4 hosts\n- Confirm whether the affected Services component is exposed over HTTP to the network; the sources do not name the specific service or port","fix":"- Apply the Oracle Solaris 11.4 security update from Oracle's Critical Patch Update that lists CVE-2026-91252; the sources do not give the patch version or ID","status":"open","published_at":"2026-10-20T22:20:26+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:04:03+00:00","updated_at":"2026-10-25T03:04:03+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:04:03Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Solaris 11.4 security update from Oracle's Critical Patch Update that lists CVE-2026-91252; the sources do not give the patch version or ID","reach":"network","title":"Oracle Solaris Services: unauthenticated HTTP request crashes or reads data","impact":"medium","summary":"An unauthenticated remote attacker sending HTTP requests to Oracle Solaris 11.4 can cause a hang or repeatable crash of the system. The same flaw also allows read access to a subset of data the system holds.","category":"infrastructure","nicknames":[],"who_cares":["solaris","oracle","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote crash of the system and read access to some data","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-91252 to get the patch ID and the affected HTTP-facing Services component.","how_to_check":"- Check the Solaris release with `uname -v` and `pkg info entire` on Oracle Solaris 11.4 hosts\n- Confirm whether the affected Services component is exposed over HTTP to the network; the sources do not name the specific service or port","needs_analyst":true,"not_affected_if":["no-network-http-services"],"who_is_affected":"Systems running Oracle Solaris 11.4 whose Services component is reachable over HTTP from the network are exposed. The sources do not say which Services component or HTTP endpoint is involved, so hosts with no network-facing HTTP services are likely less exposed. Teams not running Solaris 11.4 can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000644,"input_tokens":3471,"output_tokens":594,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-91252':13A,16A '/av':141C '11.4':33B,77C '3.1':129C,140C '8.2':132C 'abil':102C 'access':50B,86C,119C,126C 'affect':75C 'allow':48B,81C 'also':47B 'attack':26B,83C,94C 'avail':135C 'base':130C 'caus':35B,104C 'complet':111C 'compon':68C 'compromis':90C 'confidenti':133C 'crash':7A,40B,110C 'cve':11A,14A 'cvss':128C,137C,139C 'data':10A,55B,127C 'dos':112C 'easili':78C 'exploit':79C 'flaw':46B 'frequent':108C 'h':149C 'hang':37B,106C 'hold':58B 'host':21B 'http':5A,28B,88C 'impact':136C 'infrastructur':17B 'l/i':147C 'l/pr':143C 'n/a':148C 'n/ac':142C 'n/s':145C 'n/ui':144C 'network':85C 'oracl':1A,18B,31B,62C,66C,91C,114C,124C 'product':64C 'read':9A,49B,118C 'remot':25B 'repeat':39B,109C 'request':6A,29B 'result':99C 'score':131C 'self':20B 'self-host':19B 'send':27B 'servic':3A,69C 'solari':2A,22B,32B,63C,92C,115C,125C 'subset':53B,122C 'success':93C 'support':71C 'system':43B,57B,67C 'u/c':146C 'unauthent':4A,24B,82C 'unauthor':101C,117C 'vector':138C 'version':72C 'via':87C 'vulner':59C,80C,97C","nicknames":[],"mitigations":[],"who_affected":"Systems running Oracle Solaris 11.4 whose Services component is reachable over HTTP from the network are exposed. The sources do not say which Services component or HTTP endpoint is involved, so hosts with no network-facing HTTP services are likely less exposed. Teams not running Solaris 11.4 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91252","severity":null,"published_at":"2026-10-20T22:20:26+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}