Live › vulnerability › CVE-2026-91254
Go to dashboardA flaw in the Oracle Solaris 11.4 kernel can be triggered over HTTP by an unauthenticated attacker, causing a hang or repeatable crash. The sources describe only a denial of service, not code execution or data theft.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
The sources say only that Oracle Solaris 11.4 is affected and that the flaw is reachable over HTTP without credentials. They do not say which HTTP service or configuration exposes the kernel path, so systems running Solaris 11.4 that accept network traffic should be treated as in scope. unknown for whether other Solaris releases are affected.
No product ranges from the sources yet.
uname -v on each Solaris host to see the installed release and compare it with Oracle's patch advisoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-91254")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.