{"id":"CVE-2026-91254","kind":"vulnerability","aliases":["CVE-2026-91254"],"related":[],"title":"Oracle Solaris 11.4 kernel flaw lets unauthenticated network attacker crash the host","description":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","summary":"A flaw in the Oracle Solaris 11.4 kernel can be triggered over HTTP by an unauthenticated attacker, causing a hang or repeatable crash. The sources describe only a denial of service, not code execution or data theft.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","oracle","self-hosted","solaris"],"not_affected_if":["no-solaris-11.4"],"how_to_check":"- Run `uname -v` on each Solaris host to see the installed release and compare it with Oracle's patch advisory\n- unknown for other checks; the sources do not name the affected HTTP-facing service or configuration","fix":"- Apply the Oracle Solaris 11.4 kernel patch from Oracle's Critical Patch Update for the release in use\n- unknown for a specific fixed version; the sources do not give one","status":"open","published_at":"2026-10-20T22:20:26+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:18:38+00:00","updated_at":"2026-10-25T03:18:38+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:18:38Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Solaris 11.4 kernel patch from Oracle's Critical Patch Update for the release in use\n- unknown for a specific fixed version; the sources do not give one","reach":"internet","title":"Oracle Solaris 11.4 kernel flaw lets unauthenticated network attacker crash the host","impact":"medium","summary":"A flaw in the Oracle Solaris 11.4 kernel can be triggered over HTTP by an unauthenticated attacker, causing a hang or repeatable crash. The sources describe only a denial of service, not code execution or data theft.","category":"infrastructure","nicknames":[],"who_cares":["solaris","oracle","kernel","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote hang or repeatable kernel crash of the Solaris host","analyst_note":"Confirm which HTTP-facing service triggers the kernel path and the patched Solaris 11.4 SRU, using Oracle's security alert for CVE-2026-91254.","how_to_check":"- Run `uname -v` on each Solaris host to see the installed release and compare it with Oracle's patch advisory\n- unknown for other checks; the sources do not name the affected HTTP-facing service or configuration","needs_analyst":true,"not_affected_if":["no-solaris-11.4"],"who_is_affected":"The sources say only that Oracle Solaris 11.4 is affected and that the flaw is reachable over HTTP without credentials. They do not say which HTTP service or configuration exposes the kernel path, so systems running Solaris 11.4 that accept network traffic should be treated as in scope. unknown for whether other Solaris releases are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":3442,"output_tokens":626,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91254':15A,18A '/av':131C '11.4':3A,32B,81C '3.1':121C,130C '7.5':124C 'abil':106C 'access':90C 'affect':79C 'allow':85C 'attack':9A,42B,87C,98C 'avail':125C 'base':122C 'caus':43B,108C 'code':58B 'complet':115C 'compon':72C 'compromis':94C 'crash':10A,48B,114C 'cve':13A,16A 'cvss':120C,127C,129C 'data':61B 'denial':54B 'describ':51B 'dos':116C 'easili':82C 'execut':59B 'exploit':83C 'flaw':5A,27B 'frequent':112C 'h':139C 'hang':45B,110C 'host':12A,24B 'http':38B,92C 'impact':126C 'infrastructur':19B 'kernel':4A,20B,33B,73C 'l/pr':133C 'let':6A 'n/a':138C 'n/ac':132C 'n/i':137C 'n/s':135C 'n/ui':134C 'network':8A,89C 'oracl':1A,21B,30B,66C,70C,95C,118C 'product':68C 'repeat':47B,113C 'result':103C 'score':123C 'self':23B 'self-host':22B 'servic':56B 'solari':2A,25B,31B,67C,96C,119C 'sourc':50B 'success':97C 'support':75C 'system':71C 'theft':62B 'trigger':36B 'u/c':136C 'unauthent':7A,41B,86C 'unauthor':105C 'vector':128C 'version':76C 'via':91C 'vulner':63C,84C,101C","nicknames":[],"mitigations":[],"who_affected":"The sources say only that Oracle Solaris 11.4 is affected and that the flaw is reachable over HTTP without credentials. They do not say which HTTP service or configuration exposes the kernel path, so systems running Solaris 11.4 that accept network traffic should be treated as in scope. unknown for whether other Solaris releases are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91254","severity":null,"published_at":"2026-10-20T22:20:26+00:00","modified_at":"2026-10-22T19:18:03+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}