---
id: "CVE-2026-47025"
kind: "vulnerability"
aliases: ["CVE-2026-47025"]
title: "Oracle Solaris Utility flaw lets a low-privilege network user take over"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Oracle Solaris", "fixed": [], "affected": "11.3, 11.4", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "oracle-solaris", "self-hosted", "solaris"]
not_affected_if: ["managed-hosting", "unknown"]
published_at: "2026-10-20T22:19:31+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-24T00:04:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47025", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:04:02+00:00"}]
---

# Oracle Solaris Utility flaw lets a low-privilege network user take over

Oracle Solaris 11.3 and 11.4 contain a flaw in the Utility component that an attacker can reach over HTTP with a low-privilege account. Successful exploitation lets the attacker take over the system, per the CVSS 8.8 vector with full confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Solaris affected 11.3, 11.4 fixed ?

## How to check

Run 'pkg info entire' on each Solaris host; 11.3 and 11.4 are both affected. Then check whether the Utility component is reachable over HTTP to low-privilege accounts. Compare against the Solaris entry in Oracle's Oct 2026 CPU patch availability document (My Oracle Support login needed).

## Fix

Apply the Oct 2026 CPU Solaris SRU/patch from the Systems patch availability document on My Oracle Support. The exact fixed package version is not published on the public advisory: unknown. Restrict HTTP access to the host until patched.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-47025
- 2026-10-24T00:04:02+00:00 analyst — Oracle CPU Oct 2026 (20 Oct) lists Solaris 11.3/11.4; CVE record gives Utility component, HTTP, low-priv, CVSS 8.8. Fixed package versions are behind MOS patch docs and not public; no exploitation or PoC reported (Armis, Rapid7 not KEV). No public discussion searched beyond that.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-47025 https://www.cve.org/CVERecord?id=CVE-2026-47025

## From the sources

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_