Description
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: System Takeover – Full Compromise of Oracle Solaris 11.4
Action: Immediate Patch
AI Analysis

Impact

A local vulnerability exists in the Services component of Oracle Solaris 11.4 that allows a low‑privileged user with a logged‑in session to compromise the system. Successful exploitation can lead to full control over the Solaris instance, affecting confidentiality, integrity, and availability as reflected by a CVSS 3.1 base score of 7.8.

Affected Systems

Oracle Corporation’s Oracle Solaris operating system, version 11.4, is the only affected release mentioned in the advisory. No other editions or versions are listed.

Risk and Exploitability

The CVSS metrics indicate a local attack vector with low attack complexity and low privilege required, but without normal user interaction. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of exploitation is undetermined. The impact, however, is severe, and the vulnerability permits an attacker who can log on locally to gain full control of the affected Solaris instance.

Generated by OpenCVE AI on October 28, 2026 at 01:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Solaris 11.4 patch set released in the October 2026 Critical Patch Update, which addresses the CWE‑200 information exposure vulnerability.
  • Configure access controls and file permissions to limit unprivileged users from viewing or modifying sensitive system configuration files, mitigating the CWE‑200 information disclosure risk.
  • Restrict or disable diagnostic services and logs that might expose sensitive information to users, reducing the potential for information leakage per CWE‑200.
  • Audit and monitor local login activities for abnormal behavior to detect attempted exploitation of the information exposure flaw.

Generated by OpenCVE AI on October 28, 2026 at 01:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 21:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:oracle:solaris:11.4:*:*:*:*:*:*:*

Wed, 28 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title Local Privilege Exploit in Oracle Solaris 11.4 Services Enables Full System Takeover

Tue, 27 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation Allowing System Takeover in Oracle Solaris 11.4
Weaknesses CWE-269
CWE-285

Tue, 27 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation Allowing System Takeover in Oracle Solaris 11.4
Weaknesses CWE-269
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle solaris
CPEs cpe:2.3:a:oracle:solaris:11.4:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle solaris
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Solaris
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T12:05:36.512Z

Reserved: 2026-07-08T15:51:55.576Z

Link: CVE-2026-60662

cve-icon Vulnrichment

Updated: 2026-10-27T12:05:28.779Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:19:31.640

Modified: 2026-11-09T21:34:50.857

Link: CVE-2026-60662

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:30:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor