Oracle Solaris EUVD-2026-47134

Exploitation requires the attacker to already have a valid low-privileged local account with logon access to the host where Oracle Solaris 11.4 executes (PR:L, AV:L) - it cannot be triggered remotely or by an unauthenticated user. It further requires satisfying a high-complexity precondition (AC:H), meaning success depends on a specific state, timing/race window, or configuration that is not reliably present, which limits repeatable exploitation. Limiting factors: local access is mandatory, an existing account is mandatory, exploitation is difficult and not guaranteed on each attempt, and only Solaris 11.4 is affected; no user interaction is required once the attacker is on the host. The specific Utility feature involved is not named in the available data.

The signals point to a real but not urgent priority. The CVSS vector (AV:L, AC:H, PR:L, UI:N, C/I/A:H) describes a local, hard-to-exploit flaw requiring an existing low-privileged account, which is why the base score lands at 7.0 (High) rather than Critical - the local vector and high attack complexity meaningfully cap real-world exploitability. No EPSS score was provided, and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation; likewise no public POC is referenced, so this is 'no public exploit identified at time of analysis.' The main tension in the data is the 'Information Disclosure' tag versus Oracle's 'takeover' wording and full C/I/A:H impacts - the impact metrics indicate this is far more than disclosure. Net: patch in the normal Oracle CPU cycle, prioritizing multi-user or shared Solaris hosts where untrusted local accounts exist, but this is not a drop-everything network-facing emergency.

An attacker who already holds an unprivileged shell on a Solaris 11.4 server - for example a low-tier service account, a compromised developer login, or a user on a shared multi-user host - invokes the vulnerable Utility component and, after satisfying the difficult exploitation condition (AC:H), escalates to full control of the operating system. No user interaction from a victim is needed (UI:N), but no public exploit code is known, so an attacker would need to develop the technique independently.