Oracle Solaris Third Party Bulletin - October 2026
Description
The Oracle Solaris Third Party Bulletin announces patches for one or more security vulnerabilities addressed in third party software that is included in Oracle Solaris distributions. Starting January 20, 2015, Third Party Bulletins are released on the same day when Oracle Critical Patch Updates are released. These bulletins will also be updated for the following two months after their release (i.e. the two months between the normal quarterly Critical Patch Update publication dates). In addition, Third Party Bulletins may also be updated for vulnerability issues deemed too critical to wait for the next monthly update.
Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Third Party Bulletin security patches as soon as possible.
Patch Availability
- For Solaris 11.4, please visit My Oracle Support Note KB161496
- For other Solaris versions in Extended Support or Out of Support, please visit My Oracle Support Note CPU57
Third Party Bulletin Schedule
Third Party Bulletins are released on the third Tuesday of January, April, July, and October. The next four dates are:
- 19 January 2027
- 20 April 2027
- 20 July 2027
- 19 October 2027
References
- Oracle Critical Patch Updates, Security Alerts and Bulletins
- Oracle Critical Patch Updates and Security Alerts - Frequently Asked Questions
- Risk Matrix Definitions
- Use of Common Vulnerability Scoring System (CVSS) by Oracle
- Map of CVE to Bulletin
Modification History
| Date | Note |
|---|---|
| 2026-October-20 | Rev 1. Initial Release with all CVEs fixed in Solaris 11.4 SRU 96 and Solaris 11.3 ESU 36.37 |
Oracle Solaris Executive Summary
This Oracle Solaris Bulletin contains 12 new security patches for the Oracle Solaris Operating System. 8 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.
Oracle Solaris Third Party Bulletin Risk Matrix
Revision 1: Published on 2026-10-20
| CVE ID | Product | Third Party component |
Protocol | Remote Exploit without Auth.? |
CVSS VERSION 3.1 RISK (see Risk Matrix Definitions) | Supported Versions Affected |
Notes | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Base Score |
Attack Vector |
Attack Complexity |
Privs Req'd |
User Interact |
Scope | Confid- entiality |
Inte- grity |
Avail- ability |
|||||||
| CVE-2026-54906 | Oracle Solaris | concurrent-ruby | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed |
High | High | High | 11.4 | See Note 1 |
| CVE-2026-15307 | Oracle Solaris | Django | HTTP | No | 8.8 | Network | Low | Low | None | Un- changed |
High | High | High | 11.4 | See Note 2 |
| CVE-2026-63090 | Oracle Solaris | ProFTPD | SFTP | No | 8.8 | Network | Low | Low | None | Un- changed |
High | High | High | 11.4 | See Note 3 |
| CVE-2026-11332 | Oracle Solaris | Ansible | None | No | 7.8 | Local | Low | None | Required | Un- changed |
High | High | High | 11.4 | See Note 4 |
| CVE-2026-5121 | Oracle Solaris | Libarchive | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed |
None | None | High | 11.4 | See Note 5 |
| CVE-2026-54874 | Oracle Solaris | OpenSSL | HTTPS | Yes | 7.5 | Network | Low | None | None | Un- changed |
None | None | High | 11.3 | |
| CVE-2026-56865 | Oracle Solaris | Go Programming Language | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed |
None | None | High | 11.4 | See Note 6 |
| CVE-2026-59884 | Oracle Solaris | ASN.1 library for Python | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed |
None | None | High | 11.4 | See Note 7 |
| CVE-2026-69247 | Oracle Solaris | pyca-cryptography | HTTPS | Yes | 7.5 | Network | Low | None | None | Un- changed |
None | High | None | 11.4 | See Note 8 |
| CVE-2026-71217 | Oracle Solaris | iPerf | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed |
None | None | High | 11.4 | |
| CVE-2026-12912 | Oracle Solaris | LibTIFF | None | No | 7.3 | Local | Low | Low | Required | Un- changed |
High | High | High | 11.4 | |
| CVE-2026-53878 | Oracle Solaris | Django | HTTP | Yes | 6.1 | Network | Low | None | Required | Changed | Low | Low | None | 11.4 | See Note 9 |
Notes:
1. This patch also addresses CVE-2026-54905.2. This patch also addresses CVE-2026-15337 CVE-2026-15830 CVE-2026-15920.
3. This patch also addresses CVE-2026-53994 CVE-2026-63091.
4. This patch also addresses CVE-2026-16493.
5. This patch also addresses CVE-2026-14164 CVE-2026-15028 CVE-2026-16517 CVE-2026-4424 CVE-2026-4426.
6. This patch also addresses CVE-2026-33818 CVE-2026-39821 CVE-2026-46600 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864.
7. This patch also addresses CVE-2026-59885 CVE-2026-59886.
8. This patch also addresses CVE-2026-69248 CVE-2026-69249.
9. This patch also addresses CVE-2026-48588 CVE-2026-53877.