Zero Radar
← feed
CriticalVulnerabilityCVE-2026-101537updated 25 Oct 2026, 15:24 UTC

Oracle Solaris 11.4 flaw lets remote attackers take over servers

Attackers on the network can take control of a Solaris 11.4 computer without logging in. No password or user action is needed.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo credentials or user action needed
  2. 2TCP connectionSent to the reachable Solaris service
  3. 3Utility componentFlaw is triggered in the Solaris code
  4. 4Code executionAttacker gains control of the process
  5. ResultAttacker takes over the Solaris system

What happened

A critical flaw in the Utility component of Oracle Solaris 11.4 can be triggered remotely over TCP by an unauthenticated attacker, leading to full compromise of the system.

Why it is dangerous: A successful attack can give the attacker complete control over confidentiality, integrity, and availability of the affected server, so any exposed Solaris 11.4 host is at serious risk.

Are you affected?

You are affected if you run Oracle Solaris 11.4 and it is reachable over the network via TCP.

Oracle Solaris 11.4 (Utility component)

What to do

  1. Check whether any Oracle Solaris 11.4 systems are reachable from untrusted networks and restrict access with firewall rules now
  2. Check Oracle's security advisories for a patch or update for Solaris 11.4 and apply it as soon as it is available
  3. Monitor affected systems for unusual network activity and unexpected logins or processes

Timeline

  1. 20 Oct 2026, 22:18 UTC
    Publicly disclosed
  2. 20 Oct 2026, 22:18 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:24 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-101537 · GHSA-3qhx-f2f7-3qmg
CVSS
9.8 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 22:18 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:24 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Oracle Solaris 11.4 flaw lets remote attackers take over servers · Zero Radar