Oracle Solaris: Local privilege escalation in kernel
Summary
Oracle Solaris 11.4 contains a kernel flaw caused by improper privilege management (CWE-269) and missing authorization (CWE-862). An attacker with a low-privileged local logon can escalate privileges and take over the operating system. Exploitation requires a local account on the affected host; there is no direct remote attack path.
Affected
- Oracle Solaris 11.4 (only version listed as affected)
Fixed in
- Unknown. Check Oracle's October 2026 Critical Patch Update advisory for the Solaris 11.4 SRU or patch ID that fixes CVE-2026-91253.
Workaround
- None documented by the vendor.
- Interim measures (not vendor guidance): limit local and shell accounts to those needed, enforce least privilege, and review who can log on to Solaris hosts.
Exploitation
- No known exploitation reported.
- Not listed in CISA KEV (checked 21 October 2026).
- EPSS below 1%.
- No public proof of concept found; this does not prove none exists.
Our recommendation
- Inventory Solaris 11.4 hosts.
- Confirm the fixed SRU or patch ID in Oracle's October 2026 advisory and schedule patching.
- Review local accounts and privileged access on affected hosts until patched.
- Monitor for unusual privilege changes on these systems.
- Organisations without Solaris 11.4 need no specific action beyond regular CPU tracking.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 CPU www.oracle.com
- OpenCVE: CVE-2026-91253 app.opencve.io
- Vulners: CVE-2026-91253 vulners.com
- Strix: CVE-2026-91253 www.strix.ai
- Breach-Signal: Oracle October 2026 CPU breach-signal.com
- Brandefense: Oracle October 2026 CPU brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:21.
Original description (NVD)
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.