Description
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation allowing system compromise
Action: Patch Now
AI Analysis

Impact

This vulnerability resides in the kernel of Oracle Solaris 11.4, enabling an authenticated low-privileged user logged into the system to elevate privileges and compromise the entire operating system. The flaw permits a full takeover, affecting confidentiality, integrity, and availability. It is a classic privilege-escalation weakness arising from improper privilege management.

Affected Systems

Oracle Solaris 11.4 is affected. The kernel component in this version is vulnerable. The issue applies to Oracle Systems running Solaris 11.4, the only version listed as impacted.

Risk and Exploitability

The CVSS base score of 7.8 indicates high severity. The attack vector is local with low complexity, requiring only low-privileged access and no user interaction. The vulnerability may allow an attacker to gain full control of the affected Solaris system. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, but the impact remains high for any systems where an attacker can already log on locally.

Generated by OpenCVE AI on October 21, 2026 at 08:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle Solaris 11.4 security update released by Oracle to address the kernel flaw.
  • Restrict local user privileges and enforce least privilege to limit potential escalation paths.
  • Monitor audit logs for unusual privilege escalation activity and investigate promptly.

Generated by OpenCVE AI on October 21, 2026 at 08:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 21:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:oracle:solaris:11.4:*:*:*:*:*:*:*

Thu, 29 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 08:30:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle Solaris Kernel 11.4
Weaknesses CWE-269
CWE-862

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle solaris
CPEs cpe:2.3:a:oracle:solaris:11.4:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle solaris
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Solaris
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T20:34:44.144Z

Reserved: 2026-09-14T22:10:16.618Z

Link: CVE-2026-91253

cve-icon Vulnrichment

Updated: 2026-10-28T20:34:36.872Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:26.313

Modified: 2026-11-09T21:26:25.297

Link: CVE-2026-91253

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T22:30:06Z

Weaknesses