CVE-2026-46978: Oracle Solaris Auth Bypass Vulnerability

CVE-2026-46978 is an authentication bypass vulnerability in Oracle Solaris Remote Administration Daemon affecting version 11.4. This critical flaw allows unauthenticated remote attackers to compromise systems. This article covers technical details, affected versions, impact, and mitigation strategies.

CVE-2026-46978 Overview

CVE-2026-46978 is a critical vulnerability in the Remote Administration Daemon (RAD) component of Oracle Solaris 11.4. The flaw allows an unauthenticated remote attacker to compromise Oracle Solaris over HTTPS without user interaction. Successful exploitation results in unauthorized creation, deletion, or modification of all Oracle Solaris accessible data and full read access to that data. The vulnerability carries a scope change, meaning attacks may impact components beyond the vulnerable daemon. It is classified under [CWE-284] Improper Access Control.

Critical Impact
An unauthenticated network attacker can fully compromise data confidentiality and integrity across Oracle Solaris and adjacent components via HTTPS.

Affected Products

Oracle Solaris 11.4
Oracle Solaris Remote Administration Daemon (RAD) component
Systems exposing RAD over HTTPS to untrusted networks

Discovery Timeline

2026-06-17 - CVE-2026-46978 published to NVD
2026-06-18 - Last updated in NVD database
2026-06 - Addressed in the Oracle Critical Patch Update June 2026

Technical Details for CVE-2026-46978

Vulnerability Analysis

The Remote Administration Daemon (RAD) provides programmatic interfaces for managing Oracle Solaris systems. It exposes administrative APIs over multiple transports, including HTTPS. The vulnerability allows attackers with network access to bypass access control checks and invoke privileged operations without authentication.

Because the CVSS scope is changed, exploitation can affect resources beyond the vulnerable component. Attackers can manipulate or exfiltrate data belonging to other Solaris subsystems and tenants managed through the daemon. The flaw impacts confidentiality and integrity at the highest level while leaving availability untouched, indicating the vulnerability supports stealthy data manipulation rather than service disruption.

Root Cause

The issue stems from improper access control [CWE-284] in the RAD HTTPS interface. Authentication or authorization enforcement is missing or insufficient on administrative endpoints, allowing anonymous callers to reach functions intended for privileged operators. See the Oracle Security Alert for vendor technical details.

Attack Vector

The attack is network-based with low complexity, requires no privileges, and no user interaction. An attacker reaches the RAD HTTPS listener and issues administrative requests directly. Because RAD interacts with Solaris management subsystems, abuse can pivot into broader system compromise, including modification of accounts, services, and stored data accessible through the daemon.

No verified public proof-of-concept code is available. Refer to the vendor advisory for affected endpoint details.

Detection Methods for CVE-2026-46978

Indicators of Compromise

Unexpected HTTPS connections to the RAD listener (default rad:remote) from external or non-administrative source addresses.
Unauthenticated or anomalous RAD API calls invoking administrative modules such as user, zone, or service management.
Unexplained creation, modification, or deletion of Solaris accounts, services (SMF), or zones outside change-management windows.
New or modified files in administrative paths without corresponding operator authentication events.

Detection Strategies

Inspect Solaris audit trails (auditreduce, BSM) for RAD-initiated actions lacking a corresponding authenticated user session.
Correlate network flow logs against the RAD HTTPS port to identify external exposure or unauthorized clients.
Baseline expected RAD API consumers and alert on deviations using SIEM correlation rules.

Monitoring Recommendations

Forward Solaris audit, SMF, and RAD logs to a centralized SIEM for retention and correlation.
Alert on configuration changes to RAD transport bindings or TLS certificates.
Monitor for privilege changes, new administrative roles, and unexpected root-equivalent activity.

How to Mitigate CVE-2026-46978

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update June 2026 to all Oracle Solaris 11.4 systems.
Restrict network access to the RAD HTTPS listener to trusted management networks only using host-based firewalls or IPF rules.
Audit Solaris accounts, SMF services, and configuration data for unauthorized changes since the daemon was exposed.
Rotate credentials and keys reachable through RAD-managed services after patching.

Patch Information

Oracle addressed CVE-2026-46978 in the June 2026 Critical Patch Update for Solaris 11.4. Administrators should apply the latest Support Repository Update (SRU) for Solaris 11.4 from My Oracle Support. Refer to the Oracle Security Alert for SRU identifiers and installation guidance.

Workarounds

Disable the RAD remote HTTPS transport with svcadm disable svc:/system/rad:remote if remote administration is not required.
Bind RAD only to localhost or place it behind a VPN or bastion host until patching completes.
Enforce TLS client certificate authentication on network paths that must remain reachable.

bash

# Disable the RAD remote HTTPS transport on Oracle Solaris 11.4
svcadm disable svc:/system/rad:remote
svcs -xv svc:/system/rad:remote

# Restrict inbound access to the RAD listener using IP Filter
echo "block in quick proto tcp from any to any port = 6788" >> /etc/ipf/ipf.conf
echo "pass in quick proto tcp from 10.0.0.0/24 to any port = 6788" >> /etc/ipf/ipf.conf
svcadm refresh network/ipfilter