Oracle Solaris CVE-2026-91537

Exploitation requires the attacker to already have an interactive local logon with low privileges on the host where Oracle Solaris 11.4 executes (PR:L, AV:L) - there is no remote or network-reachable path. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local access exists, escalation is straightforward. The limiting factors are therefore the prerequisite valid low-privilege account/shell and physical or logical access to a Solaris 11.4 system running the affected Utility component; systems with no untrusted local users have substantially reduced exposure.

This is a local privilege-escalation flaw in Oracle Solaris 11.4 (Utility component). The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) is internally consistent with the description: exploitation requires a local logon with low privileges, no user interaction, low complexity, and yields full confidentiality, integrity and availability impact - i.e. complete host takeover. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability and automatability cannot be quantified from the input. The local attack vector (AV:L) and the PR:L requirement meaningfully cap real-world risk: an attacker must already have a foothold (a valid low-privilege account or shell) on the Solaris host, so this is a post-access escalation primitive rather than a remotely-reachable issue. There is a labeling conflict worth noting - the input Tags say 'Information Disclosure', but the CVSS impact (C:H/I:H/A:H) and the description's 'takeover' language indicate far more than disclosure; treat the tag as inaccurate, not the impact. Overall this is a genuine HIGH-severity escalation bug that should be patched on multi-user Solaris systems, but it is not a drive-by / mass-exploitation candidate and should be prioritized below remotely-exploitable unauthenticated flaws absent evidence of active exploitation.

An attacker who already holds a low-privilege local account on a Solaris 11.4 host (e.g. a developer shell, a compromised service account, or a malicious insider) invokes the vulnerable Utility component to escalate to full control of the operating system. No user interaction and no special timing are required, and attack complexity is low. No public exploit code has been identified at time of analysis.