CVE-2026-61052: Oracle Solaris Filesystems DoS Vulnerability

CVE-2026-61052 Overview

CVE-2026-61052 is a denial of service vulnerability in the Filesystems component of Oracle Solaris 11.4. A low-privileged local attacker with logon access to the infrastructure running Oracle Solaris can trigger a hang or repeatable crash, resulting in complete denial of service. The vulnerability requires no user interaction and is easily exploitable once the attacker has authenticated access to the host. Oracle addressed the issue in the July 2026 Critical Patch Update. The flaw impacts availability only, with no confidentiality or integrity impact reported.

Critical Impact
Authenticated local attackers can crash or hang Oracle Solaris 11.4, producing a complete system-level denial of service.

Affected Products

Oracle Solaris 11.4
Oracle Systems — Filesystems component
Environments where local logon access to Solaris hosts is permitted

Discovery Timeline

2026-07-21 - CVE-2026-61052 published to the National Vulnerability Database
2026-07-21 - Last updated in the NVD database
July 2026 - Addressed in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-61052

Vulnerability Analysis

The vulnerability resides in the Filesystems component of Oracle Solaris 11.4. An authenticated user with local logon rights can invoke filesystem operations that cause the operating system to hang or crash reliably. The result is a complete denial of service affecting the availability of the entire Solaris instance. The attack vector is local, meaning the adversary must already possess valid credentials or an interactive session on the host. No confidentiality or integrity properties are impacted, and no user interaction is required for successful exploitation. Oracle categorizes the issue as easily exploitable, indicating minimal technical barriers once local access is obtained. The scope remains unchanged, so the impact is confined to the affected Solaris host. The EPSS probability of exploitation is 0.135%.

Root Cause

Oracle has not published low-level technical details in the public advisory. The behavior is consistent with a filesystem-layer defect where malformed operations or crafted input trigger a kernel-level fault, leading to a hang or crash. Refer to the Oracle Critical Patch Update July 2026 advisory for vendor-specific details.

Attack Vector

Exploitation requires local access with low privileges. An attacker with a shell, SSH session, or equivalent logon capability on the Solaris host issues filesystem-related requests that induce the fault. Because the attack vector is local and privileges required are low, any authenticated user account on a shared Solaris system represents a potential exploitation channel. The vulnerability cannot be triggered remotely without a foothold on the target host.

No verified public proof-of-concept code is available for CVE-2026-61052. See the Oracle Critical Patch Update July 2026 advisory for authoritative technical guidance.

Detection Methods for CVE-2026-61052

Indicators of Compromise

Unexpected Solaris kernel panics, hangs, or reboots correlating with local user filesystem activity
Repeated crash dumps referencing the Solaris filesystem subsystem in /var/crash
Anomalous local user sessions issuing unusual sequences of filesystem operations prior to system instability

Detection Strategies

Correlate authentication logs with system crash timestamps to identify local accounts active immediately before failure
Monitor Solaris audit trails (auditreduce, BSM) for abnormal filesystem syscall patterns from non-administrative users
Track host availability metrics and alert on repeated unplanned reboots on Solaris 11.4 systems

Monitoring Recommendations

Forward Solaris syslog, audit, and crash dump metadata to a centralized logging platform for correlation
Baseline normal filesystem call volumes per user and alert on sudden deviations
Review privileged and interactive session activity on Solaris hosts on a scheduled cadence

How to Mitigate CVE-2026-61052

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Solaris 11.4 systems
Inventory Solaris 11.4 hosts and prioritize patching for multi-user and internet-adjacent systems
Restrict interactive logon rights on Solaris hosts to only accounts that require them

Patch Information

Oracle released the fix as part of the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update July 2026 advisory for the applicable patch identifiers and installation procedures for Solaris 11.4.

Workarounds

Limit local logon access on Solaris 11.4 hosts until the patch is applied
Enforce least privilege using Solaris Role-Based Access Control (RBAC) to reduce the population of accounts able to trigger the flaw
Increase monitoring of system availability and audit logs on unpatched hosts to detect exploitation attempts