Oracle

CVE-2017-3623: Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel RPC).

Is it exploited?

Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of 29 Oct 2026.

VulnCheck KEV lists it since 20 Jun 2017. It cites 1 public report, the first from 20 Jun 2017.

community.broadcom.com

How likely is exploitation in the next 30 days?

22.5%

EPSS score, percentile 97.7 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?

Not scored

The CVE record carries no CVSS score.

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected

None

Versions by product

Source: CISA KEV 2026.10.29, as of 29 Oct 2026; VulnCheck KEV, as of 30 Oct 2026; FIRST EPSS, as of 29 Oct 2026; CVE List, as of 30 Oct 2026. About the data.

Description

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel RPC). For supported versions that are affected see note. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Solaris. While the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Solaris. Note: CVE-2017-3623 is assigned for "Ebbisland". Solaris 10 systems which have had any Kernel patch installed after, or updated via patching tools since 2012-01-26 are not impacted. Also, any Solaris 10 system installed with Solaris 10 1/13 (Solaris 10 Update 11) are not vulnerable. Solaris 11 is not impacted by this issue. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Source: CVE List, as of 30 Oct 2026. About the data.

What to do

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

This summary is based on the CVE record as of 30 Oct 2026. Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Versions by product, as listed in the CVE record (1 product)

Oracle Corporation Solaris Operating System
Status	Versions
Affected	None

Source: CVE List, as of 30 Oct 2026. About the data.

Timeline

Date	Event
24 Apr 2017	CVE record published
4 Oct 2024	CVE record last updated

References

97778 (Vulnerability database)
1038292 (Vulnerability database)
oracle.com
packetstormsecurity.com

Known exploited Oracle vulnerabilities

CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability (added 24 Aug 2026)
CVE-2026-46817: Oracle E-Business Suite Improper Privilege Management Vulnerability (added 15 Jul 2026)
CVE-2026-35273: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability (added 12 Jun 2026)
CVE-2024-21182: Oracle WebLogic Server Unspecified Vulnerability (added 1 Jun 2026)
CVE-2025-61757: Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability (added 21 Nov 2025)