CVE-2020-14871

CRITICAL

CVSS Score

Published: October 21, 2020 at 02:04 PM UTC

Updated: June 17, 2026 at 02:55 AM UTC

1 product affected across 1 vendorSolaris

Using Solaris Operating System by Oracle Corporation?

Get instant alerts when new vulnerabilities affect Solaris Operating System - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL10

Exploitation

CISA KEV

Exploit prediction

EPSS 80%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score80.2%

EPSS (Exploit Prediction Scoring System) estimates a 80.2% chance this CVE is exploited in the wild within the next 30 days — higher than 100% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.

Required Action

Apply updates per vendor instructions.

Ransomware Use

Unknown

Added to KEV

Nov 3, 2021

Remediation Due

May 3, 2022

1639 days overdue

Notes

https://nvd.nist.gov/vuln/detail/CVE-2020-14871

Description

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).