CVE-2019-3010

Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The...

8.8 HighIn KEVPublic exploit

Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

13.5%Down 8.3 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

Record: CVE-2019-3010
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0: 4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List 8.8

Record: CVE-2019-3010
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2019-12649 8.8

Record: EUVD-2019-12649
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-w255-p3v2-q6mg 8.8

Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The...

Record: GHSA-w255-p3v2-q6mg
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

CISA KEV No score

Oracle Solaris Privilege Escalation Vulnerability

Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation.

Record: CVE-2019-3010
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Solaris xscreensaver log Privilege Escalation	2019-10-16
Exploit-DB	Solaris 11.4 - xscreensaver Privilege Escalation	2019-10-21
PoC in GitHub	chaizeg/privilege-escalation-breach	2020-04-13

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-3010 is a high vulnerability (CVSS 8.8) in Oracle Solaris, published October 16, 2019. CISA lists it as known to be exploited, since May 25, 2022. EUVD reports exploitation since May 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.5%, the 96th percentile. No source names a fixed version.