A critical (CVSS 9.8) vulnerability in the Utility component of Oracle Solaris 11.4 could let an unauthenticated remote attacker take over the system over TCP, according to Oracle.
What Is It
CVE-2026-101537 is a vulnerability in the Utility component of Oracle Solaris, published by Oracle ([email protected]) on October 20, 2026. Oracle describes it as "easily exploitable." An unauthenticated attacker with network access over TCP can use it to compromise Oracle Solaris, and a successful attack can result in full takeover of the system.
The NVD record is in "Received" status. NVD has not yet published its own enrichment, such as CPE mappings, so the details here come from Oracle's submitted data.
Why It Matters
Oracle scores the flaw at CVSS 3.1 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- Attack Vector: Network. It can be exploited remotely.
- Attack Complexity: Low. No special conditions are required.
- Privileges Required: None. No credentials are needed.
- User Interaction: None. No victim action is needed.
- Confidentiality, Integrity, Availability: all High. A successful attack can result in full system compromise.
The exploitability subscore is 3.9 and the impact subscore is 5.9. Together, these mean that any reachable Solaris 11.4 host running the affected Utility component may be exposed to a pre-authentication takeover.
Exploitation status: CVE-2026-101537 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the supplied sources do not confirm active exploitation. Because of the severity profile, it should still be patched as a priority.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Solaris
- Component: Utility
- Affected version: 11.4
Oracle names 11.4 as the affected supported version. NVD does not yet list any affected CPEs.
Patch Status
Oracle's record points to the October 2026 Critical Patch Update (CPU) advisory as its reference. Administrators should:
- check that advisory for the fixed Solaris 11.4 release or patch information and apply it;
- until patched, limit network exposure of affected Solaris 11.4 systems.
There is no CISA KEV entry, so no federal required action or due date applies.