Oracle Solaris: Authentication bypass in Image Packaging System allows takeover
Summary
A flaw in the Image Packaging System (IPS) component of Oracle Solaris 11.3 and 11.4 allows an unauthenticated attacker with network access via HTTP to compromise the system. Oracle rates the impact as total on confidentiality, integrity and availability, with a CVSS 3.1 base score of 9.8. No user interaction is required, so any reachable IPS HTTP service is a high-priority risk.
Affected
- Oracle Solaris 11.3
- Oracle Solaris 11.4
- Component: Image Packaging System (IPS), reachable over HTTP
Fixed in
Unknown. Check the Oracle October 2026 Critical Patch Update advisory and My Oracle Support for the fixed SRU or ESU versions.
Workaround
No vendor workaround known.
- Interim measure (not from vendor): restrict access to the IPS HTTP service to management or build networks and block it at the perimeter until patched.
Exploitation
- No known exploitation in the wild at the time of research (no CISA KEV listing found).
- No public proof of concept found; this is weak evidence of absence.
- EPSS 0.0045 at the time of the snapshot (low predicted exploitation probability).
- Reported by Positive Technologies (PT-2026-119532).
Our recommendation
- Inventory all Solaris 11.3 and 11.4 hosts and check whether IPS is running.
- Restrict network access to the IPS HTTP service now.
- Obtain the fixed versions from the Oracle October 2026 CPU advisory and apply them together with the related IPS CVEs CVE-2026-87417, CVE-2026-87421 and CVE-2026-87414.
- Re-check NVD and CISA KEV for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 www.oracle.com
- Oracle Solaris Third Party Bulletin July 2026 www.oracle.com
- NVD mirror (Vulners) vulners.com
- CNA/CVE mirror (Strix) www.strix.ai
- Vulners CNNVD record (EPSS) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:17.
Original description (NVD)
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.