Zero Radar
← feed
CriticalVulnerabilityCVE-2026-60432updated 25 Oct 2026, 18:20 UTC

Oracle Solaris package management system can be taken over remotely

Attackers on the network can send requests to an Oracle Solaris server without logging in and take full control of it. Anyone who can reach the server over HTTP could do this.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

What happened

A flaw in the Image Packaging System component of Oracle Solaris lets an unauthenticated attacker reach the system over HTTP and compromise it, with full impact on confidentiality, integrity and availability.

Why it is dangerous: A successful attack allows complete takeover of the Solaris server, meaning data theft, changes to the system, or shutting it down. Any Solaris server with the packaging service reachable over the network is at risk.

Are you affected?

You are affected if you run Oracle Solaris 11.3 or 11.4 with the Image Packaging System reachable over HTTP from a network you do not fully trust.

Oracle Solaris 11.3 and 11.4 (supported versions)

What to do

  1. Check whether the Image Packaging System HTTP service is reachable from untrusted networks and restrict access to it with a firewall
  2. Apply the Oracle Solaris security update for the Image Packaging System from Oracle's official advisory
  3. Review the server for unexpected changes or access if it was exposed

Timeline

  1. 20 Oct 2026, 22:19 UTC
    Publicly disclosed
  2. 20 Oct 2026, 22:19 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 18:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-60432 · GHSA-7wfh-973h-76v4
CVSS
9.8 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 22:19 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 18:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Oracle Solaris package management system can be taken over remotely · Zero Radar