---
id: "CVE-2026-101537"
kind: "vulnerability"
aliases: ["CVE-2026-101537"]
title: "Oracle Solaris 11.4: unauthenticated network flaw in Utility gives full takeover"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Oracle Solaris", "fixed": ["11.4 SRU96 (96.227.1)"], "affected": "11.4 (before SRU96)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "oracle-solaris-11.4", "self-hosted", "solaris"]
not_affected_if: ["not-solaris-11.4"]
published_at: "2026-10-20T22:18:03+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-23T23:08:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101537", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:08:29+00:00"}]
---

# Oracle Solaris 11.4: unauthenticated network flaw in Utility gives full takeover

Oracle Solaris 11.4 has a flaw in its Utility component that an unauthenticated attacker can reach over TCP and use to take over the host (CVSS 3.1 9.8). Fixed in Oracle's October 2026 Critical Patch Update. No exploitation or public PoC found as of Oct 23, 2026.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Solaris affected 11.4 (before SRU96) fixed 11.4 SRU96 (96.227.1)

## How to check

Run 'pkg info entire' on each Solaris 11.4 host and compare the SRU with 11.4 SRU96 (96.227.1). Anything older than SRU96 is likely exposed. Oracle's CVE-to-SRU mapping is in the Solaris risk matrix on the CPU page and My Oracle Support.

## Fix

Run 'pkg update' from the Oracle support repository to Oracle Solaris 11.4 SRU96 CPU (96.227.1; MOS Doc ID KB631614). Until patched, restrict inbound TCP to the host with firewall rules. Confirm with Oracle's risk matrix that SRU96 covers this CVE.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101537
- 2026-10-23T23:08:29+00:00 analyst — Oracle CPU Oct 2026 (Oct 20) lists Solaris 11.3/11.4; CVE record says 11.4, Utility component, CVSS 9.8, no KEV, no exploitation or PoC found. Oracle's SRU96 CPU blog is the fix vehicle but does not name this CVE; I could not read the Solaris risk matrix (page truncated), so the fixed build is inferred, not confirmed. No social search done.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] CVE Record: CVE-2026-101537 https://www.cve.org/CVERecord?id=CVE-2026-101537
- [fix] Announcing Oracle Solaris 11.4 SRU96 CPU https://blogs.oracle.com/solaris/announcing-oracle-solaris-11-4-sru96-cpu
- [mentions] Armis: CVE-2026-101537 https://cve.armis.com/CVE-2026-101537

## From the sources

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_