---
id: "CVE-2026-91255"
kind: "vulnerability"
aliases: ["CVE-2026-91255"]
title: "Oracle Solaris 11.4 kernel flaw lets unauthenticated remote hang or crash"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kernel", "oracle", "self-hosted", "solaris"]
not_affected_if: ["no-network-http-service", "other-os"]
published_at: "2026-10-20T22:20:26+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T03:18:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91255", "first_seen_at": "2026-10-23T21:57:26+00:00"}]
---

# Oracle Solaris 11.4 kernel flaw lets unauthenticated remote hang or crash

A flaw in the Oracle Solaris 11.4 kernel can be triggered over HTTP by an unauthenticated network attacker. The result is a hang or repeatable crash of the whole system, a denial of service with no code execution or data theft stated in the sources.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -v` on the host and compare against the Oracle Solaris 11.4 patch level listed in the Oracle Critical Patch Update advisory (unknown from these sources)
- Run `pkg info entire` to see the installed Solaris 11.4 release and SRU level

## Fix

- Apply the Oracle Solaris 11.4 kernel patch from the Oracle Critical Patch Update advisory for the relevant quarter (exact patch id unknown from these sources)
- Update with `pkg update` to the latest Solaris 11.4 SRU (exact version unknown from these sources)

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91255

## From the sources

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_