Oracle Solaris: Improper privilege management in Utility component
Summary
Oracle Solaris 11.4 is affected by a flaw in the Utility component classified as CWE-269 (Improper Privilege Management). A low-privileged user with a local logon on the host can exploit it to take over the system, with high impact on confidentiality, integrity and availability. The attack is not possible over the network and requires a local account. CISA's SSVC assessment rates it as not automatable, and no public exploit was found.
Affected
- Oracle Solaris 11.4 (Utility component)
Fixed in
- Unknown. The fix is part of the Oracle Critical Patch Update of October 2026, released 20 October 2026. The specific Solaris SRU or patch ID is not confirmed here; check the Solaris section of the Oracle advisory and My Oracle Support.
Workaround
- Unknown. No vendor workaround was found.
- Until patched, limit local logons on Solaris 11.4 hosts, remove unused accounts and review local access logs.
Exploitation
- No public proof of concept found; this search was limited.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in KEV according to a secondary aggregator; confirm on CISA's KEV catalogue.
Our recommendation
- Identify all Solaris 11.4 systems in your asset inventory and note which have multiple users or sensitive data.
- Apply the Solaris updates from the October 2026 Oracle Critical Patch Update as soon as they are verified in My Oracle Support.
- Restrict local accounts, remove unused ones and monitor local logons until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 www.oracle.com
- Oracle Security Alerts www.oracle.com
- NVD/CISA data via OpenCVE app.opencve.io
- Vulners CVE-2026-91537 vulners.com
- Strix CVE-2026-91537 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:11.
Original description (NVD)
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.