CISA KEV · Known exploitedCritical

CVE-2020-14871

Oracle Solaris and Zettabyte File System (ZFS)

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CV...

CVSS: 10
EPSS: 79.8%
CISA KEV: Listed
Published: 2020.10.22

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability79.8%

Technical severityCVSS 10

Vulnerability overview

Affected product and versions

Product: Oracle Solaris and Zettabyte File System (ZFS)
Affected versions: 10, 11, >= 10 < 11.1, 9
Fixed versions: 11.1

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2022.05.03

1
Identify
Confirm that Oracle Solaris and Zettabyte File System (ZFS) and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE: CWE-787
KEV added: 2021.11.03
Ransomware use: 미확인