CVE-2026-60432 is a critical (CVSS 9.8) flaw in the Image Packaging System component of Oracle Solaris 11.3 and 11.4 that lets an unauthenticated attacker with network access over HTTP take over the system.
What Is It
CVE-2026-60432 is a vulnerability in the Image Packaging System (IPS) component of Oracle Solaris. Oracle reported it (source identifier: [email protected]), and NVD published it on 2026-10-20. Oracle calls the flaw "easily exploitable." An attacker with network access via HTTP can compromise Oracle Solaris without authenticating, and a successful attack can result in full takeover of the operating system.
The supplied record does not include the technical root cause or a CWE classification. NVD lists the record's status as "Received," which means NVD has not yet completed its analysis.
Why It Matters
Oracle scores the flaw CVSS 3.1 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms:
- Attack vector: Network. It can be exploited remotely over HTTP.
- Attack complexity: Low. No special conditions are needed.
- Privileges required: None. No credentials are needed.
- User interaction: None. No action by a victim is needed.
- Impact: High for confidentiality, integrity and availability.
The exploitability subscore is 3.9 and the impact subscore is 5.9. A remote, unauthenticated, low-complexity path to full system takeover puts this in the highest risk tier for any organization running exposed Solaris systems.
Exploitation status: The supplied CISA KEV data contains no entry for this CVE. As of this writing, KEV does not confirm active exploitation, and no source reviewed here reports exploitation in the wild.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Solaris
- Component: Image Packaging System
- Affected supported versions: 11.3 and 11.4
NVD has not yet published CPE configuration data for this record.
Patch Status
Oracle's October 2026 Critical Patch Update advisory is the vendor reference for this CVE. Administrators of Solaris 11.3 and 11.4 should review that advisory and apply the fixes it lists. Because there is no KEV entry, CISA has set no federal remediation due date or required action.
Given the 9.8 score and the unauthenticated network attack path, defenders should prioritize patching. Until fixes are applied, they should check whether HTTP-reachable IPS services are exposed on Solaris hosts.
Sources
- Oracle Critical Patch Update Advisory, October 2026
- NVD: CVE-2026-60432
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)