What is the CVSS score of CVE-2026-60661?

CVE-2026-60661 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle Solaris are affected by CVE-2026-60661?

Oracle Solaris 11.4 contains a local privilege escalation vulnerability (CVE-2026-60661) enabling authenticated system users to achieve complete system compromise, with potential cross-product impact…

How to fix or mitigate CVE-2026-60661?

Within 24 hours: Identify and inventory all Oracle Solaris 11.4 deployments, document system criticality and dependent applications, and notify system owners of exposure. Within 7 days: Restrict local login access to essential administrators only, implement mandatory audit logging of all local authentication and privilege escalation attempts, enable real-time alerts for suspicious process execution and file system modifications. Within 30 days: Establish weekly monitoring of Oracle Security Advisories for patch releases; conduct testing of patch deployment procedures in non-production Solaris 11.4 systems; develop and practice rapid deployment procedures for when vendor patches become available.

Oracle Solaris CVE-2026-60661

EUVD-2026-47021 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-792x-qfwc-q624

Oracle Privilege Escalation Solaris

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local access with an existing low-privileged account (AV:L/PR:L), difficult-to-win conditions (AC:H), no user interaction, and a kernel filesystem flaw crossing a trust boundary (S:C) yielding full CIA takeover.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:59 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Local privilege escalation to full system takeover in Oracle Solaris 11.4 lets a low-privileged local user compromise the Filesystems component and, due to a scope change, significantly impact additional products beyond Solaris itself. Exploitation is rated difficult (high attack complexity) and requires an existing local logon, but a successful attack yields complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis; this was disclosed in the Oracle Critical Patch Update of July 2026 and is not listed in CISA KEV.

Technical ContextAI

The flaw resides in the Filesystems component of Oracle Solaris 11.4, Oracle's enterprise SPARC/x86 UNIX operating system. Filesystem-layer defects in a kernel-integrated OS typically stem from flawed handling of on-disk structures, mount operations, path resolution, or privileged file operations that a lower-privileged process can influence. No CWE was assigned by NVD, so the precise root-cause class (e.g., improper privilege management, race condition, or memory corruption in kernel/filesystem code) cannot be confirmed from the available data. The CVSS scope change (S:C) indicates the vulnerable filesystem component can cross a security/trust boundary, allowing impact on resources managed outside the initially exploited security authority - consistent with a kernel-level filesystem primitive that affects the broader system.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to Oracle Solaris 11.4; Oracle does not publish a discrete semantic fix version in the CPU description, so apply the corresponding Solaris 11.4 Support Repository Update (SRU) referenced by that CPU for your platform. No independent exact fix-version string is available in the provided data, so consult the CPU patch matrix for the SRU number and do not infer a version. As a compensating control until patched, restrict local logon access to Solaris 11.4 hosts to trusted administrators only and audit existing accounts, since exploitation requires a low-privileged local account - this reduces the exploitable population but does not protect against an already-compromised or malicious insider account. Given the Filesystems component and scope change, also tighten filesystem and mount-related privileges and monitor for anomalous local privilege-escalation activity; these controls limit opportunity but cannot substitute for the vendor fix.