{"id":"CVE-2026-91537","kind":"vulnerability","aliases":["CVE-2026-91537"],"related":[],"title":"Oracle Solaris 11.4: Utility flaw lets a local user take over the system","description":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"A flaw in the Utility component of Oracle Solaris 11.4 lets an attacker with a low-privileged local login compromise the operating system. Successful exploitation gives the attacker full takeover, with high impact to confidentiality, integrity and availability.","severity":"high","cvss":7.8,"epss":0.00118,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","on-prem","oracle","os","solaris"],"not_affected_if":["no-untrusted-local-logins"],"how_to_check":"- Run `uname -v` on the host and check whether it reports Solaris 11.4.\n- Check the installed Solaris release with `pkg info entire` and compare against the fixed build in Oracle's advisory.\n- unknown for exact fixed versions: the sources do not say which patch level resolves it.","fix":"- Apply the Oracle Solaris 11.4 security patch or SRU that addresses this CVE, per Oracle's Critical Patch Update.\n- Limit local shell access to trusted accounts until patched.\n- unknown for the specific fixed build: the sources do not name it.","status":"open","published_at":"2026-10-20T22:20:57+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:08:34+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:08:34Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Solaris 11.4 security patch or SRU that addresses this CVE, per Oracle's Critical Patch Update.\n- Limit local shell access to trusted accounts until patched.\n- unknown for the specific fixed build: the sources do not name it.","reach":"local","title":"Oracle Solaris 11.4: Utility flaw lets a local user take over the system","impact":"high","summary":"A flaw in the Utility component of Oracle Solaris 11.4 lets an attacker with a low-privileged local login compromise the operating system. Successful exploitation gives the attacker full takeover, with high impact to confidentiality, integrity and availability.","category":"infrastructure","nicknames":[],"who_cares":["solaris","oracle","os","on-prem"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over the Solaris system from a low-privileged login","analyst_note":"Find the Oracle Critical Patch Update entry for CVE-2026-91537 to confirm the fixed Solaris 11.4 build and the affected Utility binaries.","how_to_check":"- Run `uname -v` on the host and check whether it reports Solaris 11.4.\n- Check the installed Solaris release with `pkg info entire` and compare against the fixed build in Oracle's advisory.\n- unknown for exact fixed versions: the sources do not say which patch level resolves it.","needs_analyst":true,"not_affected_if":["no-untrusted-local-logins"],"who_is_affected":"Systems running Oracle Solaris 11.4 where untrusted or low-privileged users can log in locally. Hosts with no local logins beyond administrators have a smaller exposure, but the sources do not say whether any configuration narrows the attack. Teams running other operating systems or older Solaris releases can skip this entry.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":3436,"output_tokens":671,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-91537':16A,19A '/av':131C '11.4':3A,36B,84C '3.1':118C,130C '7.8':121C 'affect':82C 'allow':88C 'attack':39B,55B,91C,106C 'avail':65B,125C 'base':119C 'compon':32B,75C 'compromis':47B,102C 'confidenti':62B,122C 'cve':14A,17A 'cvss':117C,127C,129C 'easili':85C 'execut':100C 'exploit':52B,86C 'flaw':5A,28B 'full':56B 'give':53B 'h':139C 'h/a':138C 'h/i':137C 'high':59B 'impact':60B,126C 'infrastructur':20B,96C 'integr':63B,123C 'l/ac':132C 'l/pr':133C 'l/ui':134C 'let':6A,37B 'local':8A,45B 'login':46B 'logon':93C 'low':43B,89C 'low-privileg':42B 'n/s':135C 'on-prem':21B 'oper':49B 'oracl':1A,24B,34B,69C,73C,98C,103C,115C 'os':25B 'prem':23B 'privileg':44B,90C 'product':71C 'result':111C 'score':120C 'solari':2A,26B,35B,70C,99C,104C,116C 'success':51B,105C 'support':78C 'system':13A,50B,74C 'take':10A 'takeov':57B,113C 'u/c':136C 'user':9A 'util':4A,31B,76C 'vector':128C 'version':79C 'vulner':66C,87C,109C","nicknames":[],"mitigations":[],"who_affected":"Systems running Oracle Solaris 11.4 where untrusted or low-privileged users can log in locally. Hosts with no local logins beyond administrators have a smaller exposure, but the sources do not say whether any configuration narrows the attack. Teams running other operating systems or older Solaris releases can skip this entry.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91537","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91537","severity":null,"published_at":"2026-10-20T22:20:57+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91537","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91537","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}