CVE-2026-104117: CWE-862 Missing Authorization in illumos illumos-gate
Description
A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c does not require the solaris.network.interface.config authorization for the IPMGMT_CMD_IPMP_UPDATE command, although its handler, ipmgmt_ipmp_update_handler(), writes to the persistent ipadm configuration when the IPMGMT_PERSIST flag is set. An unprivileged local user can therefore add interfaces to, or remove them from, existing IPMP groups in the stored configuration. The running configuration is not changed; the modification takes effect when the stored configuration is next applied, such as at boot, and may disrupt network connectivity. The flaw has existed since 2021 (illumos-gate commit a73be61a), and affects any illumos distribution prior to illumos-gate commit e8d3efa1.
CVSS v4.0
Score 1.9low
Affected software
illumos
illumos-gate
OmniOS
OmniOS
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from the ipmgmtd door dispatch table not requiring the solaris.network.interface.config authorization for the IPMGMT_CMD_IPMP_UPDATE command. The handler ipmgmt_ipmp_update_handler() writes changes to the persistent ipadm configuration when the IPMGMT_PERSIST flag is set. As a result, an unprivileged local user can add or remove interfaces from IPMP groups in the stored configuration, which can disrupt network connectivity upon the next application of the configuration. The issue has been present since the illumos-gate commit a73be61a and is fixed in commit e8d3efa1.
Potential Impact
An unprivileged local user can modify the persistent IPMP configuration, potentially causing network disruptions when the configuration is next applied (e.g., at boot). The running configuration remains unchanged until then. There is no indication of remote exploitation or immediate privilege escalation. The CVSS score is low (1.9), reflecting limited impact and local attack vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in illumos-gate commit e8d3efa1. Until patched, restrict local user access to trusted users only to prevent unauthorized modification of IPMP configurations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- illumos
- Date Reserved
- 2026-10-01T18:07:53.956Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac8fb5f2cdf04f6565ebf2b
Added to database: 10/09/2026, 14:34:07 UTC
Last enriched: 10/09/2026, 14:48:34 UTC
Last updated: 10/09/2026, 17:19:10 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.