{"id":"CVE-2026-91256","kind":"vulnerability","aliases":["CVE-2026-91256"],"related":[],"title":"Oracle Solaris 11.4: HTTP service flaw allows crash and partial data read","description":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris and  unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H).","summary":"A low-privileged user with network access over HTTP can crash or hang Oracle Solaris 11.4 for a repeatable denial of service. The same flaw can also expose a subset of data the service can reach.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Solaris","fixed":["11.4 SRU96 (11.4.96.227.1)"],"affected":"11.4 (before SRU96)","ecosystem":"vendor"}],"ecosystems":[],"tags":["http","infrastructure","oracle-solaris","self-hosted","solaris-11.4"],"not_affected_if":["no-http-service-exposed","solaris-not-11.4","sru96-applied"],"how_to_check":"- Run 'pkg info entire' and compare the version to 11.4.96.227.1 or later; anything older on 11.4 is exposed.\n- Run 'svcs -a | grep -i http' and 'netstat -an | grep LISTEN' to find HTTP services listening. Oracle does not name the affected service, so this only shows possible exposure.","fix":"Update Oracle Solaris 11.4 to SRU96 (11.4.96.227.1, the October 2026 CPU) with 'pkg update' from the support repository. Oracle's patch doc is MOS KB631614. The advisory page I read does not state per-CVE that SRU96 fixes this one, so confirm in the MOS doc.","status":"open","published_at":"2026-10-20T22:20:26+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:34:10+00:00","updated_at":"2026-10-25T03:35:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:34:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Solaris 11.4: HTTP service flaw allows crash and partial data read","impact":"medium","summary":"A low-privileged user with network access over HTTP can crash or hang Oracle Solaris 11.4 for a repeatable denial of service. The same flaw can also expose a subset of data the service can reach.","category":"infrastructure","nicknames":[],"who_cares":["oracle-solaris","solaris-11.4","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Repeatable system crash and read access to a subset of data","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-91256 to get the patched Solaris SRU and the exact affected service.","how_to_check":"- Run `uname -v` on the host and confirm it is Oracle Solaris 11.4\n- Check whether the affected HTTP service component is installed and listening, the sources do not name the exact package or service","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Hosts running Oracle Solaris 11.4 that expose the affected HTTP-facing Services component to the network. The sources do not name the specific service or the configuration that makes it reachable, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000589,"input_tokens":3469,"output_tokens":485,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-91256 to get the patched Solaris SRU and the exact affected service.","search":"'-11.4':30B '-2026':14A,17A '-91256':15A,18A '/av':151C '11.4':3A,47B,86C '3.1':139C,150C '7.1':142C 'abil':112C 'access':38B,96C,129C,136C 'affect':84C 'allow':7A,90C 'also':58B 'attack':93C,104C 'avail':145C 'base':140C 'caus':114C 'complet':121C 'compon':77C 'compromis':100C 'confidenti':143C 'crash':8A,42B,120C 'cve':13A,16A 'cvss':138C,147C,149C 'data':11A,63B,137C 'denial':51B 'dos':122C 'easili':87C 'exploit':88C 'expos':59B 'flaw':6A,56B 'frequent':118C 'h':159C 'hang':44B,116C 'host':28B 'http':4A,21B,40B,98C 'impact':146C 'infrastructur':22B 'l/i':157C 'l/pr':153C 'l/ui':154C 'low':33B,91C 'low-privileg':32B 'n/a':158C 'n/ac':152C 'n/s':155C 'network':37B,95C 'oracl':1A,24B,45B,71C,75C,101C,124C,134C 'oracle':19A 'oracle-solari':23B 'partial':10A 'privileg':34B,92C 'product':73C 'reach':67B 'read':12A,128C 'repeat':50B,119C 'result':109C 'score':141C 'self':27B 'self-host':26B 'servic':5A,53B,65B,78C 'solari':2A,25B,29B,46B,72C,102C,125C,135C 'solaris':20A 'subset':61B,132C 'success':103C 'support':80C 'system':76C 'u/c':156C 'unauthor':111C,127C 'user':35B 'vector':148C 'version':81C 'via':97C 'vulner':68C,89C,107C","nicknames":[],"mitigations":[],"who_affected":"Hosts running Oracle Solaris 11.4 older than SRU96 that expose an HTTP-reachable service to the network. A low-privileged account is enough, and no user interaction is needed. Oracle does not name the service. Hosts on other Solaris versions, or with no HTTP service reachable from untrusted networks, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91256","severity":null,"published_at":"2026-10-20T22:20:26+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91256:746","url":null,"severity":null,"published_at":"2026-10-25T03:35:05+00:00","modified_at":"2026-10-25T03:35:05+00:00","first_seen_at":"2026-10-25T03:35:05+00:00","fetched_at":"2026-10-25T03:35:05+00:00","note":"Oracle CPU Oct 2026 lists the CVE (Solaris 11.4, component Services); fix vehicle is Solaris 11.4 SRU96 CPU (blog + bulletin). The pages I read do not map this CVE to SRU96 explicitly (the per-CVE matrix text was truncated, the MOS patch doc needs a login), and Oracle does not name the service. Nothing marked verified. No exploitation or PoC found (Armis, Feedly)."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1770,"url":"https://blogs.oracle.com/solaris/announcing-oracle-solaris-11-4-sru96-cpu","title":"Announcing Oracle Solaris 11.4 SRU96 CPU","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":3239,"url":"https://www.oracle.com/security-alerts/bulletinoct2026.html","title":"Oracle Solaris Third Party Bulletin - October 2026","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}