Description
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation leading to full system takeover
Action: Immediate Patch
AI Analysis

Impact

The Oracle Solaris Utility component contains an easily exploitable flaw (CWE‑269) that permits a low‑privileged user with logon access to the host to compromise the operating system. Successful exploitation can lead to full takeover, affecting confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.8 and vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected Systems

Oracle Solaris 11.4 on supported platforms is affected. No other versions are listed.

Risk and Exploitability

The vulnerability is rated high severity with a CVSS score of 7.8 and is classified as local (AV:L). While the EPSS score indicates a very low likelihood of exploitation (< 1%) and there is no KEV listing, any entity with local access and low privileges could abuse this weakness to gain full control of the Solaris system if the patch is not applied.

Generated by OpenCVE AI on October 27, 2026 at 09:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle Solaris 11.4 security patch as outlined in the official Oracle CPU Oct 2026 advisory.
  • Restrict local user privileges and enforce least privilege best practices to limit the attack surface.
  • Disable or remove unnecessary utility services that may expose the vulnerability.
  • Monitor system logs for anomalous activity and perform regular vulnerability scans.

Generated by OpenCVE AI on October 27, 2026 at 09:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:oracle:solaris:11.4:*:*:*:*:*:*:*

Tue, 27 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Local privilege escalation in Oracle Solaris Utility allows full system takeover

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle Solaris Utility
Weaknesses CWE-272
CWE-284

Mon, 26 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle Solaris Utility
Weaknesses CWE-272
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle solaris
CPEs cpe:2.3:a:oracle:solaris:11.4:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle solaris
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Solaris
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T20:08:27.962Z

Reserved: 2026-09-14T22:10:16.643Z

Link: CVE-2026-91537

cve-icon Vulnrichment

Updated: 2026-10-26T20:08:23.633Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:57.417

Modified: 2026-11-04T21:18:03.253

Link: CVE-2026-91537

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T10:00:15Z

Weaknesses
  • CWE-269

    Improper Privilege Management