Security readout for executives and security teams
Plain-English summary
CVE-2020-14758 is an Oracle Solaris 11 kernel vulnerability. A low-privileged logged-in user could, with required interaction from another person, gain unauthorized access to critical data or all data accessible to Solaris, and cause partial service disruption. It is not remote unauthenticated exposure in the provided CVE data.
Executive priority
Prioritize remediation for Solaris 11 systems with sensitive data or many local users. The business risk is unauthorized data exposure after local access, plus limited service disruption. Absence of KEV evidence lowers emergency urgency, but legacy Solaris exposure can remain material in critical infrastructure.
Technical view
Oracle reports an easily exploitable local kernel issue in Solaris 11 with CVSS 3.1 score 5.6: AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L. The main impact is confidentiality, with partial availability impact and no integrity impact listed. No CWE is provided in the source bundle.
Likely exposure
Exposure is limited to organizations running Oracle Solaris 11 where low-privileged users can log on. Systems with shared shell access, legacy application users, administrative jump access, or broad local account availability have higher practical exposure than isolated appliances with tightly controlled logins.
Exploitation context
The CVE requires local access, low privileges, and human interaction by someone other than the attacker. The source bundle does not indicate CISA KEV listing or active exploitation. Treat this as a post-login privilege and data-access risk, not as evidence of internet-scale exploitation.
Researcher notes
The available data names Solaris 11 Kernel, CVSS 5.6, local attack vector, low privileges, and required user interaction. It does not provide root-cause detail, proof-of-concept status, exploit maturity, exact patch identifiers, or affected sub-builds. Validate against Oracle CPU documentation rather than inferring version ranges.
Mitigation direction
- Identify Solaris 11 systems in production, staging, and administrative environments.
- Review Oracle October 2020 CPU guidance for applicable fixes and prerequisites.
- Apply relevant Oracle updates according to vendor instructions and change-control priority.
- Restrict local login access to only required users and service accounts.
- Monitor Oracle guidance for superseding patches or additional remediation notes.
Validation and detection
- Confirm each Solaris host version and whether it is Solaris 11.
- Verify applicable Oracle CPU patch status through approved asset or patch records.
- Review local account access for unnecessary low-privileged users.
- Check whether affected systems handle sensitive or regulated data.
- Confirm monitoring covers unusual local access and partial service disruption indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-14758 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L1.34.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.6MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpuoct2020.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.