This vulnerability in Oracle Solaris 11.4's Filesystems component permits a low privileged attacker who has logon access to the system to compromise Oracle Solaris. Exploitation can result in unauthorized modification of critical data and cause system hangs or repeated crashes, effectively causing a denial of service. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) indicates that the attack requires local access with low complexity and privileges, no user interaction, and impacts integrity and availability but not confidentiality. No vendor advisory explicitly states patch availability or remediation level for this specific vulnerability, but it is listed in Oracle's July 2026 Critical Patch Update advisory, which contains numerous security patches.

The vulnerability allows unauthorized creation, deletion, or modification of critical or all accessible data on Oracle Solaris 11.4 systems. It also enables an attacker to cause system hangs or frequent crashes, resulting in a complete denial of service. Confidentiality is not impacted. The attack requires local access with low privileges but no user interaction.

Oracle includes this vulnerability in its July 2026 Critical Patch Update advisory, which provides cumulative security patches for multiple products including Oracle Solaris. Customers are strongly advised to apply the relevant patches from this update promptly to remediate the vulnerability. Patch status for this specific vulnerability is not explicitly stated beyond inclusion in the Critical Patch Update; therefore, check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. Maintaining up-to-date patching is critical as Oracle reports ongoing attempts to exploit vulnerabilities already patched.