This vulnerability exists in the Remote Administration Daemon component of Oracle Solaris 11.4. It is easily exploitable remotely over HTTPS without authentication, allowing attackers to gain unauthorized access to critical data and perform unauthorized creation, deletion, or modification of data. The vulnerability affects the confidentiality and integrity of the system with a CVSS 3.1 score of 10.0 and scope change indicating potential impact on additional Oracle products. Oracle's June 2026 Critical Security Patch Update advisory includes this fix and strongly urges customers to apply patches promptly to prevent exploitation.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle Solaris. The vulnerability compromises confidentiality and integrity with no impact on availability. It requires no privileges and no user interaction, making it highly severe and exploitable remotely via HTTPS. The scope change suggests that other Oracle products may also be affected indirectly.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for the attack or removing unnecessary privileges and access to vulnerable packages, though these may impact functionality. Oracle’s advisory does not indicate any temporary fixes or that no action is required; patching is the primary mitigation.