This vulnerability in Oracle Solaris 11.4's Utility component permits a low privileged attacker with network access via RAD to compromise the system. The scope of impact extends beyond Solaris itself, potentially affecting additional Oracle products. Exploitation can result in unauthorized access to critical or all Solaris-accessible data and unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) reflects network attack vector, high attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references the July 2026 Critical Patch Update containing numerous patches.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Solaris and unauthorized modification (update, insert, delete) of some data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that other Oracle products may also be significantly impacted by attacks exploiting this issue.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions to mitigate this and other vulnerabilities. No specific temporary mitigations or workarounds are provided in the advisory.