Low 1.9Published Oct 9, 2026

CVE-2026-104117Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership

Updated under an hour ago (2026-10-19 10:00 UTC)

Does this affect you?

It affects illumos-gate and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for illumos-gate

Exploited in the last 30 days

A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c does not require the solaris.network.interface.config authorization for the IPMGMT_CMD_IPMP_UPDATE command, although its handler, ipmgmt_ipmp_update_handler(), writes to the persistent ipadm configuration when the IPMGMT_PERSIST flag is set. An unprivileged local user can therefore add interfaces to, or remove them from, existing IPMP groups in the stored configuration. The running configuration is not changed; the modification takes effect when the stored configuration is next applied, such as at boot, and may disrupt network connectivity. The flaw has existed since 2021 (illumos-gate commit a73be61a), and affects any illumos distribution prior to illumos-gate commit e8d3efa1.

CVSS: 1.9 LOW (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Weakness (CWE): CWE-862
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: illumos
NVD analysis: Awaiting Analysis
Record last updated: Oct 9, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

illumos illumos-gate illumos:gate (from the name)	from a73be61a80f7331c35adfa540bcf8f1546ff1e33 before e8d3efa1c56e5f2b5368600a2baeb7b1d54a07f8; fixed at e8d3efa1c56e5f2b5368600a2baeb7b1d54a07f8	CNA record
OmniOS OmniOS omnios:omnios (from the name)	from r151042 before r151054; from r151058 before r151058w; fixed at r151058w; from r151056 before r151056aw; fixed at r151056aw; from r151054 before r151054bw; fixed at r151054bw	CNA record

References

https://illumos.topicbox.com/groups/developer/T3b859664594b7762/cve-2026-104112-to-cve-2026-104117-denial-of-service-and-missing-authorization-in-door-serversmailing-list
https://illumos.org/issues/18492issue-tracking
https://github.com/illumos/illumos-gate/commit/e8d3efa1c56e5f2b5368600a2baeb7b1d54a07f8patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.