PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8330 Oracle CVE debrief

CVE-2016-8330 is an Oracle Solaris kernel vulnerability affecting Solaris 11.3. According to NVD, it is difficult to exploit, requires only network access, and can be reached by unauthenticated attackers via multiple protocols. The observed impact is integrity-only: successful exploitation could allow unauthorized update, insert, or delete access to some Solaris-accessible data. The CVSS v3.0 base score is 3.7 (LOW). While the severity is low, the fact that the issue is network-reachable and unauthenticated means exposed Solaris 11.3 systems should still be reviewed and patched according to Oracle guidance referenced in the NVD record.

Vendor
Oracle
Product
CVE-2016-8330
CVSS
LOW 3.7
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Oracle Solaris administrators, infrastructure and security teams responsible for Solaris 11.3 hosts, and any environment exposing Solaris services to untrusted networks.

Technical summary

NVD classifies the issue as affecting the Oracle Sun Systems Products Suite Solaris component, subcomponent Kernel, with the vulnerable CPE limited to oracle:solaris:11.3. The CVSS vector is CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network attack vector, high attack complexity, no privileges required, no user interaction, and integrity impact only. NVD also maps the weakness to CWE-284 (Improper Access Control).

Defensive priority

Low. Prioritize based on exposure: internet-facing or broadly reachable Solaris 11.3 systems should be checked and remediated first, but this is not marked as a KEV item in the supplied data.

Recommended defensive actions

  • Review Oracle's January 2017 Critical Patch Update advisory referenced by NVD and apply the relevant Solaris 11.3 fix if you are affected.
  • Inventory all Oracle Solaris 11.3 systems and identify which hosts are network-reachable or exposed to untrusted segments.
  • Reduce exposure of Solaris services where possible, especially on systems that do not require broad network access.
  • Validate that compensating controls and access restrictions are in place for any Solaris 11.3 host that cannot be patched immediately.
  • Track Oracle security advisories and confirm remediation status in configuration and patch-management records.

Evidence notes

All claims above are grounded in the supplied NVD record and its metadata: CVE published 2017-01-27, modified 2026-05-13, affected CPE oracle:solaris:11.3, CVSS 3.0 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, and CWE-284. The NVD record also references Oracle's January 2017 CPU advisory as the vendor patch reference. No exploit details or unsupported impact claims are included.

Official resources

CVE published: 2017-01-27T22:59:01.867Z. NVD record modified: 2026-05-13T00:24:29.033Z. No KEV date is provided in the supplied data.