Oracle · Solaris

CVE-2019-3010

Oracle Solaris Privilege Escalation Vulnerability

Exploited in attacks High 8.8 Attack chance: 13%

What it is

Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CISA: Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: June 15, 2022

Added to the CISA list: May 25, 2022
Published: October 16, 2019
Severity: High 8.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 13% in the top 3.6% of all known vulnerabilities
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from Oracle

Added	Vulnerability	Product	Severity	Attack chance
Aug 24, 2026	Improper Access ControlCVE-2026-21962	HTTP Server and Oracle Weblogic Server Proxy Plug-in	Critical 10.0	73%
Jul 15, 2026	Improper Privilege ManagementCVE-2026-46817	E-Business Suite	Critical 9.8	12%
Jun 12, 2026	PeopleSoft Enterprise PeopleTools Missing Authentication for Critical FunctionCVE-2026-35273used by ransomware	PeopleSoft Enterprise PeopleTools	Critical 9.8	97%
Jun 1, 2026	UnspecifiedCVE-2024-21182	WebLogic Server	High 7.5	74%
Nov 21, 2025	Missing Authentication for Critical FunctionCVE-2025-61757	Fusion Middleware	Critical 9.8	89%
Oct 20, 2025	Server-Side Request Forgery (SSRF)CVE-2025-61884used by ransomware	E-Business Suite	High 7.5	96%
Oct 6, 2025	UnspecifiedCVE-2025-61882used by ransomware	E-Business Suite	Critical 9.8	99.7%
Feb 24, 2025	DeserializationCVE-2024-20953	Agile Product Lifecycle Management (PLM)	High 8.8	3.9%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.