CVE-2004-2686: Sun Solaris

High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days.

Directory traversal vulnerability in the vfs_getvfssw function in Solaris 2.6, 7, 8, and 9 allows local users to load arbitrary kernel modules via crafted (1) mount or (2) sysfs system calls. NOTE: this might be the same issue as CVE-2004-1767, but there are insufficient details to be sure.

Affected products

• Sun Solaris: version 2.6 only; version 7.0 only; version 8.0 only; version 9.0 only
• Sun Sunos: affected versions not specified; version 5.7 only; version 5.8 only; version 5.9 only

Published 2004-12-31. Last modified 2026-06-16.