Oracle Solaris CVE-2026-91253

Requires an existing low-privileged interactive logon to the Oracle Solaris 11.4 host where the kernel executes (AV:L, PR:L) - this is the primary limiting factor, as the flaw is not remotely reachable and cannot be triggered by an unauthenticated network attacker. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so any local account meeting the privilege prerequisite can exploit it reliably. The affected feature is the Solaris kernel component on version 11.4; no non-default configuration is called out in the description, so default 11.4 installations are in scope. Exploitation is bounded to the single host (S:U, no scope change to other systems).

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local privilege-escalation flaw in the Oracle Solaris kernel: an attacker must already have a low-privileged logon to the host, but once there, exploitation is of low complexity, requires no user interaction, and yields full confidentiality, integrity, and availability compromise ('takeover' per Oracle's wording). No EPSS score, CISA KEV listing, POC, or SSVC decision data were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a genuine but second-stage risk rather than a perimeter threat: because AV:L requires prior local access, it is not mass-exploitable remotely and realistically functions as an escalation primitive chained after an initial foothold. Priority should be driven by environment - high for multi-user or shared Solaris infrastructure where untrusted local accounts exist, lower for single-admin hosts. Note the input 'Information Disclosure' tag understates impact: the vector and description indicate full system takeover (C:H/I:H/A:H), not mere disclosure - treat it as a kernel-level compromise.

An attacker who has already obtained a low-privileged shell on an Oracle Solaris 11.4 host (e.g., via stolen credentials, a web-app foothold, or a legitimate but limited user account) exploits a flaw in the kernel component to escalate to full root/system control. Because AC:L and UI:N, no special timing or victim interaction is needed once local access exists. No public exploit code was identified in the provided data.