Oracle Solaris EUVD-2026-106602

Requires local access: the attacker must be able to log on to or execute code on the host running Oracle Solaris 11.3 or 11.4, specifically reaching the 'Utility' component - the AV:L vector rules out remote network exploitation. No user interaction is required and attack complexity is low once local access exists. The chief limiting factors are (1) the need for a local foothold/account on the Solaris host and (2) applicability only to versions 11.3 and 11.4; note Oracle marks this PR:N despite requiring infrastructure logon, so in practice at least a local account is typically needed. No specific non-default configuration is named in the advisory.

Signals are mixed and point to a moderate, not top-tier, priority. The Oracle CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) describes a local, low-complexity attack with no user interaction that yields full confidentiality, integrity, and availability compromise (OS takeover). The critical limiter is AV:L: this is NOT remotely exploitable over the network - the attacker must already be able to run code/log on to the host. Note a conflict in the source data: Oracle scores PR:N (no privileges) yet the description states the attacker needs 'logon to the infrastructure where Oracle Solaris executes,' which implies possession of a local account; Oracle's convention of marking such local-account prerequisites as PR:N likely understates the real privilege requirement - verify with Oracle. No EPSS score, no CISA KEV listing, and no public exploit (POC) were provided in the input, so there is no evidence of active or at-scale exploitation; SSVC inputs (exploitation status, automatability) are also absent. Net: a high-CVSS local privilege-escalation/takeover bug that matters most for multi-user Solaris hosts, but the local-only vector plus absence of KEV/EPSS/POC signals makes this a patch-in-normal-cycle item rather than an emergency, absent local-access exposure in your environment.

An attacker who already holds a low-privilege local account (or has gained an initial foothold) on a Solaris 11.3 or 11.4 host invokes the vulnerable Utility component and, because the flaw is low-complexity and needs no user interaction, escalates to full control of the operating system. No public exploit code was identified in the provided data. The local attack vector means this cannot be triggered remotely over the network - the attacker must first reach the host.