Key points
- The flaw affects Oracle Solaris versions 11.3 and 11.4.
- Attackers require only network access via HTTP to exploit it.
- The NVD rates the severity as critical with a score of 9.8.
An unauthenticated attacker with network access can now fully compromise Oracle Solaris systems. This capability arises from a vulnerability within the Image Packaging System component. According to the National Vulnerability Database record for CVE-2026-60432, the flaw allows remote takeover of the operating system. The impact covers confidentiality, integrity and availability. Security teams managing these environments must treat this as an immediate risk requiring urgent attention and mitigation planning.
In plain English
The Image Packaging System handles software installation and updates for the operating system. The vulnerability resides within this specific component. An attacker does not need a user account or password to initiate the attack. They simply need to reach the server over the network using standard HTTP traffic. Once the exploit succeeds, the attacker gains complete control over the Solaris instance. This means they can read, modify or delete any data on the machine.
The background
Oracle Systems supports both version 11.3 and 11.4 of Solaris. The National Vulnerability Database explicitly lists these two releases as affected. The CVSS 3.1 Base Score is 9.8, which falls into the critical severity category. The vector string indicates that no user interaction is required for the attack to succeed. The complexity of the attack is rated as low, making it easily exploitable by threat actors with basic skills.
What changes now
Organisations running these specific versions face immediate exposure. The absence of authentication requirements lowers the barrier for entry significantly. Network access alone is sufficient for a successful compromise. The scope of the impact is unchanged, meaning the attacker operates within the same security context as the victim. The source material does not state whether a fix exists. Teams must prepare for potential containment measures while awaiting official remediation guidance.
The attacker's path
Unauthenticated remote code execution flaws typically serve as the initial entry point in an intrusion chain. Attackers use this stage to establish a foothold without triggering login alerts. Teams usually prioritise isolating affected services from public-facing networks immediately. Check whether your Image Packaging System endpoints are exposed to untrusted networks. Segmenting these critical components reduces the attack surface. Monitor for unusual outbound traffic patterns that indicate a compromised host.
What to do and how to stay safe
- Verify if your inventory includes Oracle Solaris 11.3 or 11.4 systems.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
