CVE-2019-3010

KEVOracle Solaris Privilege Escalation Vulnerability

Description

Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation.

Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

PublishedOct 16, 2019

Last modifiedJun 17, 2026

Added to KEVMay 25, 2022

Remediation dueJun 15, 2022

References

packetstormsecurity.com/files/154960/Solaris-xscreensaver-Privilege-Escalation.htmlExploitThird Party Advisory
seclists.org/fulldisclosure/2019/Oct/39Mailing ListThird Party Advisory
oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlPatchVendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3010US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1595 days
CVSS: 8.8 HIGH
EPSS (30-day exploit probability): 13.4% · top 4% of all CVEs
Weakness: NVD-CWE-noinfo

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.