Description
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution / Remote System Takeover
Action: Immediate Patch
AI Analysis

Impact

Oracle Solaris versions 11.3 and 11.4 contain a vulnerability in the Utility component that allows an attacker without local privileges to execute arbitrary code or take full control of the system by sending crafted requests over HTTP. The flaw provides high confidentiality, integrity, and availability impact, enabling an attacker to compromise the affected system entirely.

Affected Systems

Oracle Solaris 11.3 and Oracle Solaris 11.4 are affected. No other versions or sub‑packages are listed as vulnerable.

Risk and Exploitability

The CVSS v3.1 score of 8.8 indicates the vulnerability is severe and easily exploitable. The attack vector is network‑based over HTTP, requiring only low privilege. The EPSS score is < 1%, indicating a very low but non‑zero exploitation probability, and the vulnerability has not been listed in the CISA KEV catalog. A low privileged attacker can exploit this flaw to gain full control of the target system.

Generated by OpenCVE AI on October 27, 2026 at 23:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the security patch released by Oracle for Solaris 11.3 and 11.4 (see the October 2026 advisory)
  • Restrict or block HTTP service to untrusted networks using firewall rules or disable the Solaris Utility HTTP service if it is not needed
  • Configure Solaris to enforce strict user and group permissions and audit privilege usage to detect any unexpected changes after the patch

Generated by OpenCVE AI on October 27, 2026 at 23:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 21:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*
cpe:2.3:o:oracle:solaris:11.4:*:*:*:*:*:*:*

Tue, 27 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege Remote Takeover via HTTP in Oracle Solaris 11.3-11.4
Weaknesses CWE-284

Tue, 27 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege Remote Takeover via HTTP in Oracle Solaris 11.3-11.4
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle solaris
CPEs cpe:2.3:a:oracle:solaris:11.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:solaris:11.4:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle solaris
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Solaris
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T12:01:30.935Z

Reserved: 2026-05-18T15:55:10.317Z

Link: CVE-2026-47025

cve-icon Vulnrichment

Updated: 2026-10-27T12:01:23.735Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:19:31.033

Modified: 2026-11-09T21:37:26.587

Link: CVE-2026-47025

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T23:45:11Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor