Oracle Solaris Third Party Bulletin - July 2026
Description
The Oracle Solaris Third Party Bulletin announces patches for one or more security vulnerabilities addressed in third party software that is included in Oracle Solaris distributions. Starting January 20, 2015, Third Party Bulletins are released on the same day when Oracle Critical Patch Updates are released. These bulletins will also be updated for the following two months after their release (i.e. the two months between the normal quarterly Critical Patch Update publication dates). In addition, Third Party Bulletins may also be updated for vulnerability issues deemed too critical to wait for the next monthly update.
Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Third Party Bulletin security patches as soon as possible.
Patch Availability
- For Solaris 11.4, please visit My Oracle Support Note KB161496
- For other Solaris versions in Extended Support or Out of Support, please visit My Oracle Support Note CPU57
Third Party Bulletin Schedule
Third Party Bulletins are released on the third Tuesday of January, April, July, and October. The next four dates are:
- 20 October 2026
- 19 January 2027
- 20 April 2027
- 20 July 2027
References
- Oracle Critical Patch Updates, Security Alerts and Bulletins
- Oracle Critical Patch Updates and Security Alerts - Frequently Asked Questions
- Risk Matrix Definitions
- Use of Common Vulnerability Scoring System (CVSS) by Oracle
- Map of CVE to Bulletin
Modification History
| Date | Note |
|---|---|
| 2026-September-21 | Rev 2. Added CVEs fixed in Solaris 11.4 SRU 95 |
| 2026-July-21 | Rev 1. Initial Release with all CVEs fixed in Solaris 11.4 SRU 94 and Solaris 11.3 ESU 36.36 |
Oracle Solaris Executive Summary
This Oracle Solaris Bulletin contains 44 new security patches for the Oracle Solaris Operating System. 30 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.
Oracle Solaris Third Party Bulletin Risk Matrix
Revision 2: Published on 2026-09-21
| CVE ID | Product | Third Party component |
Protocol | Remote Exploit without Auth.? |
CVSS VERSION 3.1 RISK (see Risk Matrix Definitions) | Supported Versions Affected |
Notes | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Base Score |
Attack Vector |
Attack Complexity |
Privs Req'd |
User Interact |
Scope | Confid- entiality |
Inte- grity |
Avail- ability |
|||||||
| CVE-2026-54284 | Oracle Solaris | SQL Parser | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed |
High | High | High | 11.4 | See Note 1 |
| CVE-2026-57433 | Oracle Solaris | Perl | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed |
High | High | High | 11.4 | |
| CVE-2026-13221 | Oracle Solaris | Perl | HTTP | Yes | 9.1 | Network | Low | None | None | Un- changed |
None | High | High | 11.4 | |
| CVE-2026-40468 | Oracle Solaris | gawk | HTTP | Yes | 9.1 | Network | Low | None | None | Un- changed |
None | High | High | 11.4 | See Note 2 |
| CVE-2026-54058 | Oracle Solaris | Python Imaging Library (PIL) | HTTP | Yes | 9.1 | Network | Low | None | None | Un- changed |
High | None | High | 11.4 | See Note 3 |
| CVE-2026-57432 | Oracle Solaris | Perl | None | No | 8.4 | Local | Low | None | None | Un- changed |
High | High | High | 11.4 | |
| CVE-2022-33065 | Oracle Solaris | Libsndfile | None | No | 7.8 | Local | Low | None | Required | Un- changed |
High | High | High | 11.4 | |
| CVE-2026-39822 | Oracle Solaris | Go Programming Language | None | No | 7.8 | Local | Low | Low | None | Un- changed |
High | High | High | 11.4 | See Note 4 |
| CVE-2026-62574 | Oracle Solaris | JDK 8 | None | No | 7.8 | Local | Low | Low | None | Un- changed |
High | High | High | 11.4 | |
| CVE-2026-60002 | Oracle Solaris | OpenSSH | SSH | Yes | 7.7 | Network | High | None | None | Un- changed |
High | High | Low | 11.4 | See Note 5 |
| CVE-2026-37555 | Oracle Solaris | Libsndfile | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed |
None | None | High | 11.4 | See Note 6 |
| CVE-2026-56288 | Oracle Solaris | GNU patch | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed |
None | None | High | 11.4 | See Note 7 |
| CVE-2026-6879 | Oracle Solaris | Python | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed |
None | None | High | 11.4 | |
| CVE-2026-75803 | Oracle Solaris | OpenSSL | TLS | Yes | 7.5 | Network | Low | None | None | Un- changed |
None | None | High | 11.4, 11.3, 10 | See Note 8 |
| CVE-2026-7017 | Oracle Solaris | Perl | HTTP | Yes | 7.1 | Network | Low | None | Required | Un- changed |
High | Low | None | 11.4 | |
Revision 1: Published on 2026-07-21
| CVE ID | Product | Third Party component |
Protocol | Remote Exploit without Auth.? |
CVSS VERSION 3.1 RISK (see Risk Matrix Definitions) | Supported Versions Affected |
Notes | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Base Score |
Attack Vector |
Attack Complexity |
Privs Req'd |
User Interact |
Scope | Confid- entiality |
Inte- grity |
Avail- ability |
|||||||
| CVE-2026-39821 | Oracle Solaris | Go Programming Language | HTTP | Yes | 10 | Network | Low | None | None | Changed | High | High | None | 11.4 | |
| CVE-2026-32792 | Oracle Solaris | Unbound | DNS | Yes | 9.8 | Network | Low | None | None | Un- changed |
High | High | High | 11.4 | See Note 9 |
| CVE-2026-34180 | Oracle Solaris | OpenSSL | TLS | Yes | 9.8 | Network | Low | None | None | Un- changed |
High | High | High | 11.4, 11.3, 10 | See Note 10 |
| CVE-2026-5731 | Oracle Solaris | Firefox | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed |
High | High | High | 11.4 | See Note 11 |
| CVE-2026-5731 | Oracle Solaris | Thunderbird | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed |
High | High | High | 11.4 | See Note 12 |
| CVE-2026-8388 | Oracle Solaris | Firefox | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed |
High | High | High | 11.4 | See Note 13 |
| CVE-2026-8388 | Oracle Solaris | Thunderbird | HTTP | Yes | 9.8 | Network | Low | None | None | Un- changed |
High | High | High | 11.4 | See Note 14 |
| CVE-2026-38974 | Oracle Solaris | Dulwich | HTTP | Yes | 8.8 | Network | Low | None | Required | Un- changed |
High | High | High | 11.4 | See Note 15 |
| CVE-2026-5402 | Oracle Solaris | Wireshark | HTTP | Yes | 8.8 | Network | Low | None | Required | Un- changed |
High | High | High | 11.4 | See Note 16 |
| CVE-2026-9759 | Oracle Solaris | Wireshark | HTTP | Yes | 8.8 | Network | Low | None | Required | Un- changed |
High | High | High | 11.4 | |
| CVE-2026-29518 | Oracle Solaris | RSYNC | Multiple | No | 8.1 | Network | Low | Low | None | Un- changed |
High | None | High | 11.4 | See Note 17 |
| CVE-2026-41316 | Oracle Solaris | Ruby | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed |
High | High | High | 11.4 | |
| CVE-2026-4786 | Oracle Solaris | Python | HTTP | Yes | 8.1 | Network | High | None | None | Un- changed |
High | High | High | 11.4 | See Note 18 |
| CVE-2026-8643 | Oracle Solaris | PIP | HTTP | No | 8 | Network | Low | Low | Required | Un- changed |
High | High | High | 11.4 | |
| CVE-2026-34000 | Oracle Solaris | X.Org | None | No | 7.8 | Local | Low | Low | None | Un- changed |
High | High | High | 11.4 | See Note 19 |
| CVE-2026-42308 | Oracle Solaris | Python Imaging Library (PIL) | None | No | 7.8 | Local | Low | None | Required | Un- changed |
High | High | High | 11.4 | See Note 20 |
| CVE-2026-50256 | Oracle Solaris | X.Org | None | No | 7.8 | Local | Low | Low | None | Un- changed |
High | High | High | 11.4 | See Note 21 |
| CVE-2026-29170 | Oracle Solaris | Apache HTTP server | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed |
None | None | High | 11.4 | See Note 22 |
| CVE-2026-33811 | Oracle Solaris | Go Programming Language | HTTP | Yes | 7.5 | Network | High | None | Required | Un- changed |
High | High | High | 11.4 | See Note 23 |
| CVE-2026-41284 | Oracle Solaris | Apache Tomcat | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed |
None | High | None | 11.4 | See Note 24 |
| CVE-2026-42304 | Oracle Solaris | Twisted | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed |
None | None | High | 11.4 | |
| CVE-2026-44431 | Oracle Solaris | Urllib3 | HTTP | Yes | 7.5 | Network | Low | None | None | Un- changed |
None | None | High | 11.4 | See Note 25 |
| CVE-2026-46529 | Oracle Solaris | Evince | None | No | 7 | Local | High | None | Required | Un- changed |
High | High | High | 11.4 | |
| CVE-2026-6019 | Oracle Solaris | Python | HTTP | Yes | 6.8 | Network | High | None | Required | Un- changed |
High | High | None | 11.4 | |
| CVE-2026-22009 | Oracle Solaris | MySQL | Multiple | No | 6.5 | Network | Low | Low | None | Un- changed |
None | None | High | 11.4 | See Note 26 |
| CVE-2026-8328 | Oracle Solaris | Python | HTTP | Yes | 6.5 | Network | Low | None | Required | Un- changed |
None | High | None | 11.4 | See Note 27 |
| CVE-2026-3219 | Oracle Solaris | PIP | None | No | 5.8 | Local | Low | High | Required | Un- changed |
High | High | None | 11.4 | See Note 28 |
| CVE-2025-14179 | Oracle Solaris | PHP | None | No | 5.1 | Local | High | None | None | Un- changed |
None | None | High | 11.4 | See Note 29 |
| CVE-2026-1502 | Oracle Solaris | Python | HTTP | No | 4.5 | Network | Low | High | Required | Un- changed |
None | High | None | 11.4 | |
Notes:
1. This patch also addresses CVE-2026-59893 CVE-2026-59894 CVE-2026-71491 CVE-2026-84305.2. This patch also addresses CVE-2026-40467 CVE-2026-40553.
3. This patch also addresses CVE-2026-54059 CVE-2026-54060 CVE-2026-55379 CVE-2026-55380 CVE-2026-59197 CVE-2026-59198 CVE-2026-59199 CVE-2026-59200 CVE-2026-59203 CVE-2026-59204 CVE-2026-59205.
4. This patch also addresses CVE-2026-42505.
5. This patch also addresses CVE-2026-5999 CVE-2026-59995 CVE-2026-59996 CVE-2026-59997 CVE-2026-59998 CVE-2026-59999 CVE-2026-60000 CVE-2026-60001.
6. This patch also addresses CVE-2022-33065.
7. This patch also addresses CVE-2026-56289.
8. This patch also addresses CVE-2026-54874 CVE-2026-63072 CVE-2026-63074 CVE-2026-63076.
9. This patch also addresses CVE-2026-33278 CVE-2026-40622 CVE-2026-41292 CVE-2026-42534 CVE-2026-42923 CVE-2026-42944 CVE-2026-42959 CVE-2026-42960 CVE-2026-44390 CVE-2026-44608.
10. This patch also addresses CVE-2026-34181 CVE-2026-34182 CVE-2026-34183 CVE-2026-35188 CVE-2026-42764 CVE-2026-42765 CVE-2026-42766 CVE-2026-42767 CVE-2026-42768 CVE-2026-42769 CVE-2026-42770 CVE-2026-42771 CVE-2026-45445 CVE-2026-45446 CVE-2026-45447 CVE-2026-7383 CVE-2026-9076.
11. This patch also addresses CVE-2026-5732 CVE-2026-5734 CVE-2026-6746 CVE-2026-6747 CVE-2026-6748 CVE-2026-6749 CVE-2026-6750 CVE-2026-6751 CVE-2026-6752 CVE-2026-6753 CVE-2026-6754 CVE-2026-6757 CVE-2026-6759 CVE-2026-6761 CVE-2026-6762 CVE-2026-6763 CVE-2026-6764 CVE-2026-6765 CVE-2026-6766 CVE-2026-6767 CVE-2026-6769 CVE-2026-6770 CVE-2026-6771 CVE-2026-6772 CVE-2026-6776 CVE-2026-6785 CVE-2026-6786.
12. This patch also addresses CVE-2026-5732 CVE-2026-5734 CVE-2026-6746 CVE-2026-6747 CVE-2026-6748 CVE-2026-6749 CVE-2026-6750 CVE-2026-6751 CVE-2026-6752 CVE-2026-6753 CVE-2026-6754 CVE-2026-6757 CVE-2026-6759 CVE-2026-6761 CVE-2026-6762 CVE-2026-6763 CVE-2026-6764 CVE-2026-6765 CVE-2026-6766 CVE-2026-6767 CVE-2026-6769 CVE-2026-6770 CVE-2026-6771 CVE-2026-6772 CVE-2026-6776 CVE-2026-6785 CVE-2026-6786.
13. This patch also addresses CVE-2026-7320 CVE-2026-7321 CVE-2026-7322 CVE-2026-7323 CVE-2026-8090 CVE-2026-8091 CVE-2026-8092 CVE-2026-8094 CVE-2026-8391 CVE-2026-8401 CVE-2026-8946 CVE-2026-8947 CVE-2026-8949 CVE-2026-8950 CVE-2026-8953 CVE-2026-8954 CVE-2026-8955 CVE-2026-8956 CVE-2026-8957 CVE-2026-8958 CVE-2026-8959 CVE-2026-8961 CVE-2026-8962 CVE-2026-8968 CVE-2026-8970 CVE-2026-8974 CVE-2026-8975.
14. This patch also addresses CVE-2026-7320 CVE-2026-7321 CVE-2026-7322 CVE-2026-7323 CVE-2026-8090 CVE-2026-8091 CVE-2026-8092 CVE-2026-8094 CVE-2026-8391 CVE-2026-8401 CVE-2026-8946 CVE-2026-8947 CVE-2026-8949 CVE-2026-8950 CVE-2026-8953 CVE-2026-8954 CVE-2026-8955 CVE-2026-8956 CVE-2026-8957 CVE-2026-8958 CVE-2026-8959 CVE-2026-8961 CVE-2026-8962 CVE-2026-8968 CVE-2026-8970 CVE-2026-8974 CVE-2026-8975.
15. This patch also addresses CVE-2026-42305 CVE-2026-42563 CVE-2026-47712 CVE-2026-47734.
16. This patch also addresses CVE-2026-5299 CVE-2026-5401 CVE-2026-5403 CVE-2026-5404 CVE-2026-5405 CVE-2026-5406 CVE-2026-5407 CVE-2026-5408 CVE-2026-5409 CVE-2026-5653 CVE-2026-5654 CVE-2026-5655 CVE-2026-5656 CVE-2026-5657 CVE-2026-6519 CVE-2026-6520 CVE-2026-6521 CVE-2026-6522 CVE-2026-6523 CVE-2026-6524 CVE-2026-6525 CVE-2026-6526 CVE-2026-6527 CVE-2026-6528 CVE-2026-6529 CVE-2026-6530 CVE-2026-6531 CVE-2026-6532 CVE-2026-6533 CVE-2026-6534 CVE-2026-6535 CVE-2026-6536 CVE-2026-6537 CVE-2026-6538 CVE-2026-6867 CVE-2026-6868 CVE-2026-6869 CVE-2026-6870 CVE-2026-7375 CVE-2026-7376 CVE-2026-7378 CVE-2026-7379.
17. This patch also addresses CVE-2026-43617 CVE-2026-43618 CVE-2026-43619 CVE-2026-43620 CVE-2026-45232.
18. This patch also addresses CVE-2026-4519 CVE-2026-6100.
19. This patch also addresses CVE-2026-33999 CVE-2026-34001 CVE-2026-34002 CVE-2026-34003.
20. This patch also addresses CVE-2026-40192 CVE-2026-42309 CVE-2026-42310 CVE-2026-42311.
21. This patch also addresses CVE-2025-26597 CVE-2026-50257 CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262 CVE-2026-50263 CVE-2026-50264.
22. This patch also addresses CVE-2026-29167 CVE-2026-34355 CVE-2026-34356 CVE-2026-42535 CVE-2026-42536 CVE-2026-43951 CVE-2026-44119 CVE-2026-44185 CVE-2026-44186 CVE-2026-44631 CVE-2026-48913 CVE-2026-49975.
23. This patch also addresses CVE-2026-33814 CVE-2026-39817 CVE-2026-39819 CVE-2026-39820 CVE-2026-39823 CVE-2026-39825 CVE-2026-39826 CVE-2026-39836 CVE-2026-42499 CVE-2026-42501.
24. This patch also addresses CVE-2026-41293 CVE-2026-42498 CVE-2026-43512 CVE-2026-43513 CVE-2026-43514 CVE-2026-43515.
25. This patch also addresses CVE-2026-44432.
26. This patch also addresses CVE-2026-21998 CVE-2026-22001 CVE-2026-22002 CVE-2026-22004 CVE-2026-22005 CVE-2026-22015 CVE-2026-22017 CVE-2026-34267 CVE-2026-34270 CVE-2026-34271 CVE-2026-34276 CVE-2026-34278 CVE-2026-34293 CVE-2026-34303 CVE-2026-34304 CVE-2026-34308 CVE-2026-35236 CVE-2026-35237 CVE-2026-35238 CVE-2026-35239 CVE-2026-35240.
27. This patch also addresses CVE-2021-4189.
28. This patch also addresses CVE-2026-6357.
29. This patch also addresses CVE-2026-42371 CVE-2026-6104 CVE-2026-6722 CVE-2026-6735 CVE-2026-7258 CVE-2026-7259 CVE-2026-7261 CVE-2026-7262 CVE-2026-7263 CVE-2026-7568.