CVE-2026-46978: Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon)

Synopsis

This is a critical-severity authentication bypass and data compromise vulnerability in the Remote Administration Daemon (RAD) component of Oracle Solaris 11.4. An unauthenticated attacker with network access over HTTPS can reach the affected service with no prerequisites, no victim interaction, and no special knowledge of the target environment. Successful exploitation gives the attacker full read and write access to all data accessible by Oracle Solaris, and the impact crosses scope boundaries, meaning other products co-hosted with the affected system are also at risk. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Remote Administration Daemon over the network via HTTPS; no local or physical access is required, but the service must be network-exposed.

• AuthenticationNot required

  No credentials or account of any privilege level are needed; the attack can be launched anonymously over HTTPS.

• Victim interactionNot required

  No user action, click, or social engineering is required; the attacker operates entirely without victim involvement.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and repeatable without needing to engineer race conditions, specific memory layouts, or other environmental dependencies.

Blast Radius

• Reads all data accessible to Oracle Solaris, including stored credentials, configuration files, and application data.
• Creates, modifies, or deletes critical data across the full Oracle Solaris data set, enabling persistent tampering or sabotage.
• Because the CVSS scope is Changed, other products sharing the host or managed through RAD are also reachable by a successful attacker, extending the compromise beyond the Solaris instance itself.