CVE-2026-91537
HighCVSS 7.8Summary
Vulnerability in Oracle Solaris (version 11.4) allows a low-privileged attacker with logon to the infrastructure to take over the system. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).
Risk Assessment
A low-privileged attacker can take over the Solaris system, potentially leading to full compromise of the operating system.
Recommendation
Update Oracle Solaris to the latest version and restrict user account privileges to the minimum necessary.
Other vulnerabilities in Oracle Solaris
See all- CVE-2026-91348High
Vulnerability in Oracle Solaris (component Utility) versions 11.3 and 11.4. An easily exploitable local attack allows an unauthenticated attacker with logon to the infrastructure to take over the system.
- CVE-2026-91256High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services) affecting version 11.4. A low privileged attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS) and unauthorized read access to a subset of data.
- CVE-2026-91255High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel) affecting version 11.4. An unauthenticated attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-91254High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel) affecting version 11.4. An unauthenticated attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-91253High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel) affecting version 11.4. A low privileged attacker with local logon to the infrastructure can exploit it to take over Oracle Solaris.
- CVE-2026-91252High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services) affecting version 11.4. An unauthenticated attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS) and unauthorized read access to a subset of data.
- CVE-2026-91242High
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugins) affecting version 11.4. A high privileged attacker with local logon can exploit it with human interaction to gain unauthorized creation, deletion or modification access to critical data and complete access to all accessible data, with scope change impacting additional products.
- CVE-2026-87421High
Vulnerability in Oracle Solaris (Image Packaging System component) affecting version 11.4. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to gain unauthorized access to and modify critical data, requiring user interaction.
- CVE-2026-87417High
Vulnerability in Oracle Solaris (Image Packaging System component) affecting version 11.4. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to gain unauthorized access to critical data.
- CVE-2026-60662High
Vulnerability in the Oracle Solaris product (component: Services) affecting version 11.4. An easily exploitable flaw allows a low-privileged attacker with logon access to the infrastructure to compromise Oracle Solaris.
Original NVD description (English source)
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS