This vulnerability affects Oracle Solaris 11.4 in the Utility component and allows a low privileged attacker with network access via RAD to compromise the system. The attack can result in unauthorized access to critical or all accessible data and unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes many patches, but no explicit patch or remediation details for this specific vulnerability are provided in the advisory content. Oracle strongly recommends applying patches promptly to mitigate risks.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Solaris and unauthorized modification (update, insert, delete) of some data. The confidentiality impact is high, integrity impact is low, and availability is not affected. The vulnerability also has scope change implications, meaning it may impact additional Oracle products beyond Solaris. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends that customers remain on actively-supported versions and apply security patches without delay. Since no specific patch or temporary fix is explicitly stated for this vulnerability, monitoring the vendor advisory for updates is essential.