Oracle Solaris Third Party Bulletin - July 2026

THREAT INTELLIGENCE

Peer Review

4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.

ISO 27001 text with a globe outline symbol on a black background.

2025 winner badge for Cyber Security Excellence Awards with gold and black design.

Critical

CVE-2026-39821, CVE-2026-32792, CVE-2026-34180, CVE-2026-5731, CVE-2026-8388

Oracle

July 21, 2026

Executive Summary

29 CVEs affecting third-party components bundled with Oracle Solaris. Highest severity is CVE-2026-39821 (CVSS 10) in the Go Programming Language; multiple additional critical and high severity flaws.

Key Details

Affected Platform

Oracle Solaris

Attack Surface

Recommended Action

Apply vendor patch

Affected Environment

Oracle Solaris 11.4, 11.3, and 10, via third-party components including Go, OpenSSL, Firefox, Thunderbird, Wireshark, Python, Apache HTTP Server, Apache Tomcat, Ruby, and others.

Operational Impact

Critical severity flaws in Go, OpenSSL, and browser components could allow remote code execution or full system compromise on affected Solaris hosts.

Technical Root Cause

Vulnerabilities originate in upstream third-party open source components bundled with Solaris. Root causes vary by component: memory safety issues, cryptographic flaws, and improper input handling.

Recommended Mitigation

Apply Oracle Solaris patches via Oracle support.
Prioritise systems with internet-facing OpenSSL, Apache, or DNS services.
Restrict browser usage (Firefox, Thunderbird) on Solaris production systems.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Managed Detection and Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

Oracle Solaris Third Party Bulletin July 2026, CVE-2026-39821, CVE-2026-32792, CVE-2026-34180, CVE-2026-5731, CVE-2026-8388, Oracle Security Alerts Page