{"id":"CVE-2026-60432","published":"2026-10-20T22:19:31.283","lastModified":"2026-10-21T18:44:55.490","description":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287","CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows unauthenticated attackers to completely compromise Oracle Solaris systems through the Image Packaging System component, affecting versions 11.3 and 11.4. The flaw enables full system takeover with high impact on confidentiality, integrity, and availability.","exploitability":"The vulnerability is easily exploitable with no authentication required, allowing attackers to access vulnerable Oracle Solaris systems via HTTP network connections.","blast_radius":"If exploited, this vulnerability could lead to complete compromise of affected Oracle Solaris servers, potentially affecting critical enterprise infrastructure and data systems.","remediation":"Apply the latest Oracle Critical Patch Update (CPU) for Oracle Solaris 11.3 and 11.4, or upgrade to Oracle Solaris 11.5 or later versions which contain the fix for this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","solaris","remote-exploit"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:24:15.904Z"}}