CVE-2020-14871: Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: yes — in CISA KEV since 2021-11-03
EPSS: 80.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-10-21 · updated 2026-06-17
Weakness: CWE-787

Description

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Affected products

Oracle Corporation Solaris Operating System: from 10 before 11.1; 9 — fixed in 11.1

How to fix

Upgrade to a fixed version: Oracle Corporation Solaris Operating System 11.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-14871 or the next vulnerability affects your stack