A vulnerability in the utility component of Oracle Solaris allows an attacker who can log on to the infrastructure where the operating system runs to compromise the system. The flaw is exploitable from a local environment and does not require authentication, resulting in the attacker gaining full control over the affected Solaris release. The impact of a successful exploit includes the loss of confidentiality, integrity and availability of the affected machine, consistent with the CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 8.4.

Oracle Corporation’s Solaris operating system, specifically versions 11.3 and 11.4, are impacted. These releases contain the vulnerable utility component and are listed in the CVE advisory.

The vulnerability carries a high severity CVSS score of 8.4. Because the attack requires local access and no remote exploit is documented, the threat is estimated to be moderate to high for environments that allow local logons. EPSS data is unavailable and the flaw is not yet listed in the CISA KEV catalog, but the potential for complete system takeover warrants urgent attention. A local attacker who can log on—whether physically or via remote console—can exploit the weakness and obtain full administrative control.