CVE-2026-91348
HighCVSS 8.4Summary
Vulnerability in Oracle Solaris (component Utility) versions 11.3 and 11.4. An easily exploitable local attack allows an unauthenticated attacker with logon to the infrastructure to take over the system.
Risk Assessment
An attacker with local access can take over the Oracle Solaris system, posing high risk to confidentiality, integrity, and availability.
Recommendation
Update Oracle Solaris to a patched version and restrict local access to the infrastructure.
Other vulnerabilities in Oracle Solaris
See all- CVE-2026-91537High
Vulnerability in Oracle Solaris (version 11.4) allows a low-privileged attacker with logon to the infrastructure to take over the system. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-91256High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services) affecting version 11.4. A low privileged attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS) and unauthorized read access to a subset of data.
- CVE-2026-91255High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel) affecting version 11.4. An unauthenticated attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-91254High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel) affecting version 11.4. An unauthenticated attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-91253High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel) affecting version 11.4. A low privileged attacker with local logon to the infrastructure can exploit it to take over Oracle Solaris.
- CVE-2026-91252High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services) affecting version 11.4. An unauthenticated attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS) and unauthorized read access to a subset of data.
- CVE-2026-91242High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugins) affecting version 11.4. A high privileged attacker with local logon can exploit it with human interaction to gain unauthorized creation, deletion or modification access to critical data and complete access to all accessible data, with scope change impacting additional products.
- CVE-2026-87421High
Vulnerability in Oracle Solaris (Image Packaging System component) affecting version 11.4. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to gain unauthorized access to and modify critical data, requiring user interaction.
- CVE-2026-87417High
Vulnerability in Oracle Solaris (Image Packaging System component) affecting version 11.4. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to gain unauthorized access to critical data.
- CVE-2026-60662High
Vulnerability in the Oracle Solaris product (component: Services) affecting version 11.4. An easily exploitable flaw allows a low-privileged attacker with logon access to the infrastructure to compromise Oracle Solaris.
Original NVD description (English source)
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS