Oracle Solaris: Unauthenticated remote takeover via TCP in Utility component
Summary
Oracle Solaris 11.4 contains a critical vulnerability in the Utility component that can be exploited remotely over TCP without authentication or user interaction. According to the CNA record, a successful attack can lead to a full takeover of the system with impact on confidentiality, integrity and availability. The sources do not identify the affected TCP service, so exposure depends on which Solaris services are reachable from untrusted networks.
Affected
- Oracle Solaris 11.4 (per CNA record; NVD analysis pending)
- Oracle's advisory has not been verified for 11.3 status for this CVE
Fixed in
- Solaris 11.4 SRU96 CPU (released 20 Oct 2026) is the latest October 2026 Critical Patch Update, but it has not been confirmed to fix this CVE
- Check the Oracle October 2026 CPU advisory Solaris entry and the SRU96 README for the per-CVE fix status
Workaround
- Unknown. No vendor-documented workaround found.
- Interim measure: restrict TCP access to Solaris 11.4 hosts to trusted networks until the CPU is applied (generic hardening, not a vendor workaround)
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found; this is not exhaustive.
- Not listed in CISA KEV according to the Strix page; the KEV catalogue was not checked directly.
- EPSS 0.0042 at time of capture.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
Our recommendation
- Identify all Oracle Solaris 11.4 hosts and their reachable TCP services.
- Confirm in Oracle's October 2026 CPU advisory that SRU96 covers this CVE, then apply it.
- Restrict network access to affected services on internet-facing or partner-facing interfaces until patched.
- Monitor Solaris hosts for unusual TCP connections and re-check NVD, the Oracle advisory and CISA KEV for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 www.oracle.com
- Oracle Solaris 11.4 SRU96 CPU announcement blogs.oracle.com
- Oracle Security Alerts www.oracle.com
- Vulners CVE record CVE-2026-101537 vulners.com
- Strix CVE-2026-101537 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:21.
Original description (NVD)
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.