Live › vulnerability › CVE-2026-91256
Go to dashboardA low-privileged user with network access over HTTP can crash or hang Oracle Solaris 11.4 for a repeatable denial of service. The same flaw can also expose a subset of data the service can reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running Oracle Solaris 11.4 older than SRU96 that expose an HTTP-reachable service to the network. A low-privileged account is enough, and no user interaction is needed. Oracle does not name the service. Hosts on other Solaris versions, or with no HTTP service reachable from untrusted networks, are less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Oracle Solaris | vendor | 11.4 (before SRU96) | 11.4 SRU96 (11.4.96.227.1) |
11.4.96.227.1, the October 2026 CPU) with pkg update from the support repositoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris and unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-91256")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.