This vulnerability in Oracle Solaris 11.4's Filesystems component permits a low privileged attacker with logon access to the system to perform unauthorized modifications to critical data or all data accessible by Oracle Solaris. Additionally, the attacker can cause the system to hang or crash repeatedly, resulting in a complete denial of service. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) indicates that the attack requires local access with low privileges and low attack complexity, with no user interaction needed. The impact affects data integrity and system availability but not confidentiality. There is no explicit vendor remediation level stated in the advisory, and no direct patch link is provided in the input data. The vendor advisory references the July 2026 Critical Patch Update, which typically includes patches for such vulnerabilities.

An attacker with low privileges and logon access to the Oracle Solaris 11.4 infrastructure can exploit this vulnerability to gain unauthorized ability to create, delete, or modify critical or all accessible data, compromising data integrity. The attacker can also cause the system to hang or crash frequently, resulting in a complete denial of service, impacting system availability. Confidentiality is not impacted according to the CVSS vector.

Patch status is not yet confirmed from the provided data; the vendor advisory references the July 2026 Critical Patch Update, which likely includes fixes for this vulnerability. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Until patches are applied, restrict logon access to trusted users only and monitor for unusual system behavior related to filesystem operations.