This vulnerability in Oracle Solaris Utility component (versions 11.3 and 11.4) permits a low privileged attacker with local logon to compromise the system, resulting in unauthorized creation, deletion, or modification of critical or all accessible data. The vulnerability affects confidentiality and integrity with a CVSS 3.1 score of 7.5 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N). The attack scope includes potential impact on additional products beyond Oracle Solaris. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all Oracle Solaris accessible data, resulting in significant confidentiality and integrity breaches. The vulnerability allows a low privileged attacker with local access to escalate their impact on the system. There is no indication of availability impact. The scope of the vulnerability extends beyond Oracle Solaris to potentially affect additional products.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying the latest Critical Patch Updates promptly to mitigate known vulnerabilities. Until a specific patch is confirmed, restrict local access to trusted users only and monitor for unusual activity consistent with attempts to exploit local vulnerabilities.