This vulnerability in Oracle Solaris 11.4's Utility component permits a low privileged attacker who has logon access to the system infrastructure to compromise Oracle Solaris, potentially resulting in full system takeover. The CVSS 3.1 vector indicates local attack vector (AV:L), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The vendor advisory from Oracle does not explicitly confirm the availability of a patch or fix for this specific vulnerability as of the July 2026 Critical Patch Update advisory, which includes many patches but does not detail this CVE's patch status. Therefore, patch status is not yet confirmed and should be verified with Oracle's official security advisories.

Successful exploitation can lead to full compromise and takeover of Oracle Solaris 11.4 systems, affecting confidentiality, integrity, and availability of the system. The attacker requires only low privileges and local access but must overcome high attack complexity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant Critical Patch Updates promptly to mitigate vulnerabilities. Until a patch is confirmed, restrict local access to trusted users only and monitor for suspicious activity related to privilege escalation attempts.