CVE-2026-46914

Think of this like a dangerous weakness in a storage/drive handling part of Oracle Solaris. If someone manages to log into the machine with low privileges, they may be able to peek at sensitive data and also make the system crash repeatedly, which can stop your services.

This matters if your business runs Oracle Solaris 11.4 on any server where the filesystem component is in use. The finding indicates exploitation requires a low-privileged attacker to have a logon to the infrastructure where Oracle Solaris executes.
Only a risk if attackers can reach and log into that Solaris host with low privileges.

This is AMBER because while there’s no public exploit code on record and it’s not listed in CISA KEV, the weakness is described as easily exploitable for a low-privileged attacker with a logon, and it can lead to repeatable crashes (complete denial of service) and data exposure. Act quickly if you run Oracle Solaris 11.4, focusing on patching and reducing who can log into the host.

1. Confirm exposure (version check):
   • Verify whether your Oracle Solaris instances are exactly 11.4. The finding says the affected supported version is 11.4.
2. Determine the exact fix for your stream:
   • Open Oracle’s security alert linked in the findings (https://www.oracle.com/security-alerts/cspujun2026.html).
   • From that page, locate the remediation details (patch set / fixed update) that apply to your current Solaris 11.4 update level.
3. Upgrade/patch to the fixed state:
   • Apply the vendor remediation per Oracle’s documented Solaris patching process.
   • If you have multiple Solaris 11.4 systems, patch them in priority order (public-facing or highest-importance systems first).
4. If patching is delayed (temporary risk reduction):
   • Restrict access to the Solaris hosts so that low-privileged logons are harder to obtain.
   • Remove or disable unused accounts and tighten “who can log in” controls (for example, limit administrative and user access to approved personnel and known networks).
5. After patching:
   • Monitor for stability improvements and any signs of compromise (especially recurring crash/restart patterns), since the finding includes hang/crash outcomes.
6. Tracking:
   • Re-check Oracle’s alert for updates to the remediation guidance, as well as any further advisories that clarify affected configurations.

CVE-2026-46914 affects Oracle Solaris (component: Filesystem), specifically Oracle Solaris 11.4. Findings indicate an attacker with low privileges and a logon to the host where Oracle Solaris executes can compromise confidentiality and availability, including unauthorized access to sensitive data and repeatable hangs/crashes (denial of service). No KEV listing was provided, and there is no public exploit code on record, so exploit maturity appears limited publicly; however, the issue is still described as “easily exploitable” under the stated precondition (logon with low privilege). EPSS is provided as a low predicted likelihood (not used as a primary driver because KEV/news would override, and KEV/news are not present here). The fix is available via Oracle’s security alert at https://www.oracle.com/security-alerts/cspujun2026.html.