CVE-2026-60661 in Solaris
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the filesystem component of Oracle Solaris version 11.4, representing a significant security weakness that can be exploited by attackers with low privileges who have already gained logon access to the target system. The CVSS 3.1 base score of 7.8 indicates a high-severity issue that affects confidentiality, integrity, and availability simultaneously, making it particularly dangerous for enterprise environments where Solaris systems operate. The attack vector is classified as local (AV:L) meaning exploitation requires physical or logical access to the system, while the high attack complexity (AC:H) suggests sophisticated techniques may be necessary to achieve successful compromise.
The vulnerability's scope extends beyond just Oracle Solaris itself, creating a potential cascade effect that can impact additional products within the same infrastructure. This scope change characteristic makes the threat particularly concerning for organizations with integrated systems where Solaris serves as a foundational component. The low privilege requirement (PR:L) means that even users with minimal system access can potentially exploit this weakness, amplifying the attack surface and increasing the likelihood of successful compromise.
From an operational impact perspective, successful exploitation of this vulnerability could result in complete takeover of the Oracle Solaris system, providing attackers with full control over file operations, system resources, and potentially enabling lateral movement throughout the network. The confidentiality impact is rated as high (C:H) indicating that sensitive data stored on or processed by the affected filesystems could be accessed by unauthorized parties. Integrity impact (I:H) suggests that attackers could modify critical system files or data, potentially corrupting system functionality or injecting malicious content. The availability impact (A:H) indicates that attackers could disrupt system operations through various means such as resource exhaustion or file system corruption.
This vulnerability aligns with CWE-119 (Improper Access Control) and potentially CWE-264 (Permissions, Privileges, and Access Controls) categories, which represent fundamental security flaws in access control mechanisms. The attack patterns associated with this issue would likely follow ATT&CK techniques such as T1078 (Valid Accounts), T1566 (Phishing), and T1059 (Command and Scripting Interpreter) to establish initial access and then leverage the filesystem vulnerability for privilege escalation or system takeover.
Organizations should implement immediate mitigations including applying Oracle's security patches and updates, conducting thorough network segmentation to limit potential lateral movement, implementing robust monitoring for unauthorized file system access patterns, and establishing strict access controls that minimize the number of users with logon privileges to Solaris systems. Regular vulnerability assessments and penetration testing should be performed to identify similar weaknesses in related systems that may be impacted by this scope change vulnerability. System administrators should also consider implementing additional logging and alerting mechanisms specifically designed to detect anomalies in filesystem operations that could indicate exploitation attempts.