Is CVE-2026-104116 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104116 being exploited in the wild.

How severe is CVE-2026-104116?

Informational severity, published 9 October 2026.

Which products and versions are affected?

Illumos prior to illumos-gate commit 865b58d2.

Is there a fix for CVE-2026-104116?

Yes: fixed in illumos-gate commit 865b58d2 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104116 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-104116?

Check whether you run Illumos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104116: illumos zones statistics daemon authorization bypass

CVE-2026-104116 · Severity: info · Published 2026-10-09

The illumos zones statistics daemon (zonestatd), which monitors resource usage across virtual zones, fails to verify user credentials before processing administrative commands. An unprivileged local user can exploit this to disrupt zone statistics collection in other zones and determine which zones are currently running on the system.

Technologies: Illumos. Vendors: Illumos.

Quick answers

Is CVE-2026-104116 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104116 being exploited in the wild.
How severe is CVE-2026-104116?: Informational severity, published 9 October 2026.
Which products and versions are affected?: Illumos prior to illumos-gate commit 865b58d2.
Is there a fix for CVE-2026-104116?: Yes: fixed in illumos-gate commit 865b58d2 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104116 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-104116?: Check whether you run Illumos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: illumos-gate commit 865b58d2 and later

Technical details

A missing door_ucred authorization check in zsd_server() in zonestatd allows unprivileged local users to send the ZSD_CMD_NEW_ZONE command via an accessible door interface. By sending this command with arbitrary zone IDs, an attacker can trigger door file recreation in target zones (causing denial of service to zonestat clients) and infer zone execution state through response timing side-channels.

Affected products

illumos illumos prior to illumos-gate commit 865b58d2

Timeline

2026-10-09: disclosed
2026-10-09: patched: illumos-gate commit 865b58d

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.