CVE-2026-91336: Medium severity Oracle Solaris vulnerability
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Oracle Solaris 11.4 systems are affected. Exploitation requires an attacker to have a low-privileged account and log on to the infrastructure where Oracle Solaris is running, so it is not described as remotely exploitable without prior local access.
What could an attacker do after successful exploitation?
A successful attack can enable unauthorized creation, deletion, or modification of critical data or any data accessible to Oracle Solaris. The scope change also indicates that impacts may significantly affect additional products.
Is user interaction or a complex attack setup required?
No user interaction is required, and the attack complexity is low. The attacker must still have low privileges and local logon access to the affected infrastructure.