CVE-2020-14871: Oracle Solaris PAM out-of-bounds write allows remote unauthenticated takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 10.0, unauthenticated network reachability, full host takeover, public exploit code and CISA KEV listing make this an urgent patching priority for any exposed Solaris 10/11 system.

What it is

Oracle Solaris 10 and 11 contain an out-of-bounds write (CWE-787) in the Pluggable Authentication Module component, reachable over the network without authentication. Successful exploitation can fully compromise the host, and Oracle notes attacks may significantly impact additional products. Solaris 11.1 and later and ZFSSA 8.7 and later are not exploitable, which is why Oracle assigned a 0.0 base score for those releases.

Impact

An unauthenticated network attacker can achieve remote code execution and full takeover of the affected Solaris system, with high confidentiality, integrity and availability impact. Because the scope is changed, connected or dependent products may also be compromised.

Attack surface

Reached over the network via multiple protocols (CVSS AV:N, AC:L, PR:N, UI:N); no authentication or user interaction is required. Public exploit write-ups specifically target SunSSH and the PAM parse_user_name buffer overflow.

Exploitation

CVE-2020-14871 is listed in CISA KEV (added 2021-11-03) and has an EPSS 30-day probability of about 0.80 (99.6th percentile). Multiple references are tagged Exploit, indicating public exploit code exists; no ransomware campaign use is documented.

What to do

• Apply the Oracle October 2020 CPU patches for Solaris 10 and 11 immediately; confirm 11.1+ and ZFSSA 8.7+ are not affected.
• If patching cannot be completed, restrict network access to SSH and other PAM-dependent services on affected Solaris hosts to trusted management networks.
• Disable or tightly firewall unnecessary network services that invoke PAM authentication on Solaris 10/11 systems.
• Monitor Oracle and CISA advisories for updated patches and required actions tied to the KEV entry.
• Inventory all Solaris 10 and 11 hosts, including appliances, to ensure none remain unpatched.

Detection

• Hunt for exploitation attempts against SunSSH/PAM by reviewing SSH and authentication logs for malformed usernames, crashes or unexpected root sessions on Solaris 10/11.
• Monitor for unexpected processes, new listening services or privilege changes on Solaris hosts that could indicate post-exploitation.
• Use network detection to flag anomalous or oversized authentication payloads to Solaris SSH and other PAM-backed services.
• Correlate host telemetry with known public exploit indicators from the Packetstorm and oss-security references.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.