CVE-2020-14871

CVE-2020-14871 is a critical (CVSS 10.0) out-of-bounds write (CWE-787) in the Pluggable authentication module (PAM) component of Oracle Solaris 10 and 11. An unauthenticated attacker with network access can trigger the buffer overflow via multiple protocols without credentials or user interaction; public exploits demonstrate remote root takeover through SunSSH on Solaris 11.0 x86. Because PAM is shared across many network services, successful attacks may significantly impact additional products, and the flaw is explicitly not exploitable on Solaris 11.1 and later or ZFSSA 8.7 and later. The vulnerability was added to CISA KEV on 2021-11-03, carries an EPSS of ~80% (100th percentile), and related reporting notes the threat actor UNC1945 used it as a Solaris zero-day, confirming in-the-wild exploitation.

What to do: Apply Oracle's updates per vendor instructions, as required by the CISA KEV listing, prioritizing Solaris 10 and Solaris 11.0 systems (Solaris 11.1+ and ZFSSA 8.7+ are not exploitable). Reduce exposure of internet-facing SunSSH and other PAM-backed network services on unpatched Solaris hosts, and hunt for exploitation consistent with UNC1945 activity.