Oracle Solaris 11.4: SRUs and security updates

Updated November 2026

Oracle Solaris 11.4 gets security fixes through Support Repository Updates (SRUs) in Oracle's support repository. Run pkg update into a new boot environment, reboot into it, and keep the old boot environment as an instant way back. Access to the support repository requires an Oracle support contract.

Support timeline

Oracle's Lifetime Support Policy (effective July 11, 2025) gives these dates, as of November 2026:

Oracle Solaris support dates (as of November 2026)
Release	Released	Premier Support ends	Extended Support ends
Solaris 11.4	August 2018	November 2031	November 2037
Solaris 11.3	October 2015	January 2021 (ended)	January 2027
Solaris 10	January 2005	January 2018 (ended)	January 2027

Solaris 11.4 follows a "continuous delivery" model: new features arrive as updates to 11.4, not as a new release. Oracle reviews its support dates every year and says they apply "through at least" the dates shown. After Extended Support, Sustaining Support continues indefinitely, but it includes no new patches, security fixes or Critical Patch Updates.

Solaris 10 and 11.3 end soon. Extended Support for both ends in January 2027. After that they get no new security fixes. Plan the move to 11.4 now.

SRUs and Critical Patch Updates

SRUs are cumulative. Each SRU contains every fix from earlier SRUs, so you only ever install the newest one. Every SRU needs a reboot.
CPU SRUs. One SRU each quarter is a Critical Patch Update (CPU) SRU, released with Oracle's quarterly Critical Patch Update on the third Tuesday of January, April, July and October. The next dates are January 19, 2027 and April 20, 2027.
Cadence in 2026. Oracle's update guide (May 2025) describes monthly SRUs with every third one a CPU SRU. In 2026 Oracle moved to fewer SRUs. The Solaris Third Party Bulletins show SRU 94 with the July 2026 CPU, SRU 95 later that quarter, and SRU 96 with the October 2026 CPU.
IDRs. For urgent problems between SRUs, Oracle support can supply an Interim Diagnostic or Relief (IDR) package for your system.

Oracle's advice: install every SRU. If you cannot reboot that often, install at least each quarterly CPU SRU.

Check your release and SRU

pkg list entire
pkg info entire
pkg list -af entire
pkg publisher

The entire package fixes the version of the whole OS. Its branch version has the form minor.update.sru.order.platform.build.rev, so a branch starting 11.4.96. means Solaris 11.4 SRU 96. pkg list -af entire shows which versions your configured repository offers. pkg publisher should show https://pkg.oracle.com/solaris/support/ as the origin of the solaris publisher.

Connect to the support repository

Create a key and certificate with your Oracle support account at pkg-register.oracle.com. Then, as root, point the solaris publisher at the support repository:

pkg set-publisher -k /root/pkg.oracle.com.key.pem \
  -c /root/pkg.oracle.com.certificate.pem \
  -G '*' -g https://pkg.oracle.com/solaris/support/ solaris

Use the paths where you saved the two files. -G '*' removes all existing origins and -g adds the support repository. Many sites mirror it to a local repository and point their servers there instead. A local repository must contain the complete content of each SRU you want to install; you can fill it from the support repository or from SRU repository files downloaded from My Oracle Support.

Apply updates now

Preview first, then update into a new boot environment (BE). Commands need root, the Software Installation rights profile (use pfexec) or sudo:

sudo pkg update -nv
sudo pkg update --be-name s11.4-sru96
sudo beadm list

-nv shows what would change: packages, services that would restart, and whether a new BE is needed. The real update clones the running system, updates the clone and activates it for the next boot. Your running system is not touched. Some packages need you to add --accept to accept their license.

Reboot into the new BE (this restarts the server):

sudo init 6
pkg list entire

After the reboot, pkg list entire confirms the new SRU. In beadm list, the flag N marks the BE running now and R the one used on next boot.

Zones

A pkg update in the global zone also updates normal (solaris-branded) non-global zones, one after another. Add -C 0 to update them in parallel. Kernel zones and Solaris 10 branded zones are separate images: update them from inside each zone.

Roll back with boot environments

If the new SRU breaks something, activate the previous BE and reboot (this restarts the server):

sudo beadm activate s11.4-sru94
sudo init 6

Use the BE name shown by beadm list. Only file systems under the BE root are cloned. Shared file systems such as application data are not, so a rollback does not undo data changes. Delete BEs you no longer need with beadm destroy name, but keep at least one known-good BE.

Find which CVEs are fixed

Each SRU has a matching support/critical-patch-update/solaris-11-cpu package that lists the CVEs it fixes. It is not installed by default; installing it lets you search CVEs locally:

pkg search -Hlo value info.cve:
pkg search -Hpo pkg.shortfmri CVE-2026-12345:

The first line lists all CVE fixes installed. The second shows which versions of the CPU package fix one CVE (replace the example ID). To see if a newer CPU package exists, run pkg list -n solaris-11-cpu.

Automatic checks

Solaris does not install updates on its own, and every SRU needs a reboot, so schedule the install yourself. Automate the check: pkg update -n exits with status 4 when there is nothing to update, so a cron job can alert on any other result. Set your monitoring to flag servers whose entire version is older than the latest CPU SRU.

Where advisories are published

Critical Patch Updates, Security Alerts and Bulletins: oracle.com/security-alerts/, with a link to subscribe to email notifications. Out-of-band Security Alerts appear there too.
Solaris Third Party Bulletins: fixes for third-party (mostly open-source) software shipped with Solaris. They are published on the same day as each CPU, updated once between CPUs, and updated sooner for critical problems. Each one names the SRU that contains the fixes.
Patch details: the bulletins point to My Oracle Support note KB161496 for Solaris 11.4 patch availability.

For a quick method of reading advisories, see Security advisories.

On an older release

Solaris 11.3 gets fixes through ESU updates until January 2027 (the October 2026 bulletin names 11.3 ESU 36.37). Upgrade 11.3 to 11.4 with pkg update, after checking that your repository has both the installed 11.3 packages and the 11.4 packages. Read Oracle's 11.3 upgrade notes first. Solaris 10 cannot be upgraded with pkg: move the applications to a new 11.4 system, or run the old system as a Solaris 10 branded zone on 11.4 while you migrate. See Is my OS supported? for planning.