Can network attackers seize full control of Oracle Solaris 11.3/11.4 IPS without credentials via HTTP?

The short version

• Oracle Solaris 11.3 and 11.4 contain a high-severity flaw in the Image Packaging System.
• Unauthenticated attackers can achieve full system compromise through standard HTTP connections.
• The US National Vulnerability Database assigns a CVSS score of 9.8 to this issue.

The details

The US National Vulnerability Database records CVE-2026-60432 as a critical vulnerability within Oracle Systems products. The flaw resides specifically in the Image Packaging System component of Oracle Solaris. According to the advisory, versions 11.3 and 11.4 are the supported releases currently affected by this defect. The vulnerability is described as easily exploitable, meaning the complexity of the attack is low for potential adversaries. Security teams managing these specific operating system versions face immediate risk if their systems are accessible over a network.

The context

The CVSS 3.1 vector indicates that the attack vector is network-based and requires no user interaction or privileges. An attacker with mere network access via HTTP can trigger the exploit. Successful exploitation results in a complete takeover of the Oracle Solaris environment. The impact covers confidentiality, integrity, and availability, all rated as high. This allows an adversary to read, modify, or disrupt system operations entirely. No other operating systems or software components are mentioned in the source material.

Next steps

Organisations should immediately audit their infrastructure to identify any instances of Oracle Solaris 11.3 or 11.4. Teams must verify whether the Image Packaging System is exposed to untrusted networks. If exposure exists, network segmentation should be applied to restrict HTTP access to authorised management interfaces only. Until a vendor update is confirmed, limiting external connectivity reduces the attack surface. Monitoring for unusual HTTP traffic to these services is essential for early detection.

What defenders should look for

Security operations teams should monitor for unusual HTTP requests targeting package management endpoints. Look for spikes in traffic from untrusted sources or repeated connection attempts from single IPs. Check system logs for unexpected process spawns or permission changes following web requests. Verify that no new administrative accounts have been created. Inspect outbound connections for data exfiltration indicators. Ensure that firewall rules strictly limit access to management ports. Review audit trails for any configuration modifications made outside standard maintenance windows.

What to do and how to stay safe: Oracle Solaris

• Inventory all systems running Oracle Solaris 11.3 and 11.4 to determine exposure.
• Restrict HTTP access to the Image Packaging System using firewall rules or network segmentation.
• Monitor web server logs for anomalous traffic patterns targeting package management interfaces.
• Prepare to apply vendor patches once an official update is released and tested.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Oracle Solaris versions are affected by CVE-2026-60432?

The vulnerability affects supported versions 11.3 and 11.4 of Oracle Solaris.

What is the CVSS score for this vulnerability?

The US National Vulnerability Database assigns a CVSS 3.1 Base Score of 9.8.

Does an attacker need credentials to exploit this flaw?

No, the vulnerability allows unauthenticated attackers with network access via HTTP to compromise the system.