CVE-2019-3010: Oracle Solaris XScreenSaver local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityConfirmed KEV entry with public exploit code and a high CVSS score, though exploitation requires an existing local account rather than remote access.

What it is

A flaw in the XScreenSaver component of Oracle Solaris 11 allows a low-privileged user with a local logon to escalate privileges and take over the system. It matters because the affected component is present on default Solaris installations and the flaw is trivially reachable by any local account holder.

Impact

An attacker with a local account gains full control of the Solaris host, with high confidentiality, integrity and availability impact, and the scope change means other products reachable from that host can also be affected.

Attack surface

Reached locally: the CVSS vector is AV:L with PR:L and UI:N, so the attacker needs a valid logon on the Solaris system but no user interaction and no network access.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-05-25, and public exploit code is referenced (Packet Storm), so exploitation is confirmed in the wild; EPSS 30-day probability is about 13.4 percent (96th percentile).

What to do

• Apply the Oracle October 2019 Critical Patch Update for Solaris 11 (or later) as the primary fix.
• If patching is delayed, restrict local logon and interactive access to trusted users only.
• Audit and remove unnecessary local accounts and shared credentials on Solaris hosts.
• Monitor for unexpected privilege changes or root-level activity originating from XScreenSaver processes.

Detection

• Alert on XScreenSaver process activity that spawns shells or writes to privileged paths.
• Monitor for local privilege escalation patterns such as unexpected setuid execution or new root sessions from non-admin accounts.
• Review Solaris audit logs for suspicious logon and su/sudo activity correlated with XScreenSaver.
• Track patch state of Solaris 11 hosts against the October 2019 CPU baseline.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.