# CVE-2020-14871: Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability

Source: https://junglewise.ai/threats/cve-2020-14871-oracle-solaris-and-zettabyte-file-system-zfs-unspecified  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-11-03. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2020-14871 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2021-11-03

A critical out-of-bounds write vulnerability in the Pluggable Authentication Module (PAM) component of Oracle Solaris allows unauthenticated attackers to compromise the system via multiple protocols. Successful exploitation can lead to a complete takeover of the affected Oracle Solaris or ZFS Storage Appliance systems.

Technologies: [Oracle Solaris](https://junglewise.ai/threats/technologies/solaris). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2020-14871 exploited in the wild?** Yes. CVE-2020-14871 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.

**How severe is CVE-2020-14871?** Critical severity, with a CVSS score of 10, published 3 November 2021.

**Which products and versions are affected?** Oracle Solaris 10, 11 (prior to 11.1); Oracle ZFS Storage Appliance Kit Prior to 8.7.

**Is there a fix for CVE-2020-14871?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2020-14871 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2020-14871?** Check whether you run Oracle Solaris or Oracle Zettabyte File System (Zfs). Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Oracle Solaris 10, 11 (prior to 11.1)
- Oracle ZFS Storage Appliance Kit Prior to 8.7

## Timeline

- 2020-10-20: advisory: Initial Oracle security alert published
- 2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities catalog
- 2021-11-03: disclosed: NVD publication date
- 2021-11-03: exploited: Confirmed as exploited in the wild per CISA KEV catalog

## Related threats

- [Oracle Solaris privilege escalation in utility component](https://junglewise.ai/threats/cve-2026-91537-vulnerability-in-the-oracle-solaris-product-of-oracle-systems)
- [Oracle Solaris privilege escalation in Utility component](https://junglewise.ai/threats/cve-2026-91348-vulnerability-in-the-oracle-solaris-product-of-oracle-systems)
- [Oracle Solaris privilege escalation in Utility component](https://junglewise.ai/threats/cve-2026-91336-vulnerability-in-the-oracle-solaris-product-of-oracle-systems)
- [Oracle Solaris denial of service in Libraries component](https://junglewise.ai/threats/cve-2026-91324-vulnerability-in-the-oracle-solaris-product-of-oracle-systems)
- [Oracle Solaris Services denial of service and information disclosure](https://junglewise.ai/threats/cve-2026-91256-vulnerability-in-the-oracle-solaris-product-of-oracle-systems)