Is CVE-2026-104114 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104114 being exploited in the wild.

How severe is CVE-2026-104114?

Informational severity, published 9 October 2026.

Which products and versions are affected?

Illumos prior to illumos-gate commit 0f1064d9.

Is there a fix for CVE-2026-104114?

Yes: fixed in illumos-gate commit 0f1064d9 onwards. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104114 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-104114?

Check whether you run Illumos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104114: illumos Network Auto-Magic daemon NULL pointer dereference

CVE-2026-104114 · Severity: info · Published 2026-10-09

The illumos Network Auto-Magic daemon (nwamd) is responsible for automatic network configuration on illumos systems. An unprivileged local user can crash this daemon by making a malformed request, which disables automatic network configuration until the service is manually restarted. While the impact is limited to denial of service and requires the network service to be explicitly enabled (not the default), repeated attacks can leave the system in a broken state.

Quick answers

Is CVE-2026-104114 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104114 being exploited in the wild.
How severe is CVE-2026-104114?: Informational severity, published 9 October 2026.
Which products and versions are affected?: Illumos prior to illumos-gate commit 0f1064d9.
Is there a fix for CVE-2026-104114?: Yes: fixed in illumos-gate commit 0f1064d9 onwards. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104114 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-104114?: Check whether you run Illumos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: illumos-gate commit 0f1064d9 onwards

Technical details

A NULL pointer dereference in nwamd_door_switch() within usr/src/cmd/cmd-inet/lib/nwamd/door_if.c occurs because the function writes to the caller's request structure before validating that a request was supplied or checking caller credentials. The vulnerability is triggered when an unprivileged local user calls door_call() on the accessible /etc/svc/volatile/nwam/nwam_door with no argument data, causing an immediate crash. The fix validates input before dereferencing.

Affected products

illumos prior to illumos-gate commit 0f1064d9

Timeline

2026-10-09: disclosed: CVE-2026-104114 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.