{"id":"CVE-2026-91253","kind":"vulnerability","aliases":["CVE-2026-91253"],"related":[],"title":"Oracle Solaris 11.4 kernel flaw lets local users take over the system","description":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"A flaw in the Solaris 11.4 kernel lets a low-privileged local user with logon access compromise the operating system. A successful attack can give full takeover, with high impact to confidentiality, integrity and availability.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","on-prem","oracle","solaris"],"not_affected_if":["no-local-logins","no-solaris-11.4"],"how_to_check":"- Run `uname -v` on each Solaris host to see the release build.\n- Run `pkg info entire` to list the installed Solaris 11.4 package version.\n- Check whether untrusted or shared local user accounts exist on the host.","fix":"- Apply the Oracle Solaris 11.4 kernel security update from Oracle's Critical Patch Update for the period this CVE was published (exact patch id unknown from sources).\n- Reboot into the updated boot environment after install.","status":"open","published_at":"2026-10-20T22:20:26+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:08:48+00:00","updated_at":"2026-10-25T03:08:48+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:08:48Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Solaris 11.4 kernel security update from Oracle's Critical Patch Update for the period this CVE was published (exact patch id unknown from sources).\n- Reboot into the updated boot environment after install.","reach":"local","title":"Oracle Solaris 11.4 kernel flaw lets local users take over the system","impact":"high","summary":"A flaw in the Solaris 11.4 kernel lets a low-privileged local user with logon access compromise the operating system. A successful attack can give full takeover, with high impact to confidentiality, integrity and availability.","category":"infrastructure","nicknames":[],"who_cares":["solaris","oracle","on-prem","infrastructure"],"confidence":0.6,"needs_auth":"yes","worst_case":"Local user gains kernel control and takes over the whole Solaris system","analyst_note":"Check Oracle's Critical Patch Update advisory for the patched kernel build and exact fixed package version for Solaris 11.4.","how_to_check":"- Run `uname -v` on each Solaris host to see the release build.\n- Run `pkg info entire` to list the installed Solaris 11.4 package version.\n- Check whether untrusted or shared local user accounts exist on the host.","needs_analyst":true,"not_affected_if":["no-solaris-11.4","no-local-logins"],"who_is_affected":"Systems running Oracle Solaris 11.4 where a person or process can log in locally. Hosts with no local logons beyond administrators are at lower practical risk, but the sources do not say which configurations are exposed. Teams running only non-Solaris systems can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000643,"input_tokens":3438,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91253':15A,18A '/av':126C '11.4':3A,30B,79C '3.1':113C,125C '7.8':116C 'access':41B 'affect':77C 'allow':83C 'attack':48B,86C,101C 'avail':60B,120C 'base':114C 'compon':70C 'compromis':42B,97C 'confidenti':57B,117C 'cve':13A,16A 'cvss':112C,122C,124C 'easili':80C 'execut':95C 'exploit':81C 'flaw':5A,26B 'full':51B 'give':50B 'h':134C 'h/a':133C 'h/i':132C 'high':54B 'impact':55B,121C 'infrastructur':19B,91C 'integr':58B,118C 'kernel':4A,31B,71C 'l/ac':127C 'l/pr':128C 'l/ui':129C 'let':6A,32B 'local':7A,37B 'logon':40B,88C 'low':35B,84C 'low-privileg':34B 'n/s':130C 'on-prem':20B 'oper':44B 'oracl':1A,23B,64C,68C,93C,98C,110C 'prem':22B 'privileg':36B,85C 'product':66C 'result':106C 'score':115C 'solari':2A,24B,29B,65C,94C,99C,111C 'success':47B,100C 'support':73C 'system':12A,45B,69C 'take':9A 'takeov':52B,108C 'u/c':131C 'user':8A,38B 'vector':123C 'version':74C 'vulner':61C,82C,104C","nicknames":[],"mitigations":[],"who_affected":"Systems running Oracle Solaris 11.4 where a person or process can log in locally. Hosts with no local logons beyond administrators are at lower practical risk, but the sources do not say which configurations are exposed. Teams running only non-Solaris systems can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91253","severity":null,"published_at":"2026-10-20T22:20:26+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}