What is the CVSS score of CVE-2026-60833?

CVE-2026-60833 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle Solaris are affected by CVE-2026-60833?

Oracle Solaris 11.4 systems face a high-severity local privilege escalation vulnerability that could allow any system user to gain administrative control and compromise all sensitive data and…

How to fix or mitigate CVE-2026-60833?

Within 24 hours, identify all Oracle Solaris 11.4 instances and create a list of which systems are business-critical. Within 7 days, apply Oracle's July 2026 Critical Patch Update to all affected systems, prioritizing business-critical systems first; for systems that cannot be patched immediately, restrict standard user logon access and implement enhanced monitoring of privilege escalation attempts. Within 30 days, complete patch deployment across all Solaris 11.4 systems and verify no unpatched instances remain in the environment.

Oracle Solaris CVE-2026-60833

EUVD-2026-47134 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-3p4g-2994-749g

Oracle Privilege Escalation Solaris

7.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Requires an existing local low-privileged account (AV:L, PR:L) and a difficult trigger condition (AC:H); successful compromise yields full OS takeover (C:H/I:H/A:H) within the same instance (S:U).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:54 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.0

DescriptionCVE.org

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Local privilege escalation and full compromise in Oracle Solaris 11.4 (Utility component) allows a low-privileged local user with logon access to the host to take over the operating system, impacting confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.0 and flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Solaris is a Unix operating system used primarily on SPARC and x86 enterprise servers. The flaw resides in the 'Utility' component of Solaris 11.4 - typically a bundled system utility or setuid helper reachable by any interactive account - and the CVSS scope is unchanged (S:U), meaning exploitation compromises the Solaris instance itself rather than a separate security boundary. No CWE was assigned in the source data, so the precise root-cause class (e.g., improper privilege management, race condition, or input validation flaw in a privileged binary) cannot be confirmed; the AC:H rating suggests a condition such as a timing/race window or a specific non-trivial state is required. The 'Information Disclosure' tag conflicts with the full C/I/A 'takeover' language in Oracle's description, and the latter (High to all three impacts) should be treated as authoritative.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle distributes Solaris 11.4 fixes as Support Repository Updates (SRUs), so update to the SRU referenced in the CPU for CVE-2026-60833 - no standalone fix version string was provided in the input, so treat 'Patch available per vendor advisory' as the patch status and confirm the exact SRU number from the CPU matrix. Because exploitation requires a local low-privileged account, the most effective compensating control until patching is to restrict interactive/logon access on affected Solaris 11.4 hosts to trusted administrators only, and audit and minimize local accounts and shared-shell access; on multi-tenant or jump-host systems, consider RBAC hardening and restricting execution of the affected utility, accepting that tightening account access may disrupt legitimate operator workflows. No effective network-layer mitigation applies since the attack vector is local.