Is CVE-2026-104117 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104117 being exploited in the wild.

How severe is CVE-2026-104117?

Informational severity, published 9 October 2026.

Which products and versions are affected?

Illumos prior to commit e8d3efa1.

Is there a fix for CVE-2026-104117?

Yes: fixed in illumos-gate commit e8d3efa1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104117 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-104117?

Check whether you run Illumos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104117: illumos ipmgmtd missing authorization check in IPMP configuration

CVE-2026-104117 · Severity: info · Published 2026-10-09

The illumos IP management daemon (ipmgmtd) is responsible for managing network configuration on illumos systems. A missing authorization check allows unprivileged local users to modify persistent IP multipathing (IPMP) group configurations by adding or removing network interfaces, which can disrupt network connectivity when the configuration is next applied, such as at boot time.

Technologies: Illumos. Vendors: Illumos.

Quick answers

Is CVE-2026-104117 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104117 being exploited in the wild.
How severe is CVE-2026-104117?: Informational severity, published 9 October 2026.
Which products and versions are affected?: Illumos prior to commit e8d3efa1.
Is there a fix for CVE-2026-104117?: Yes: fixed in illumos-gate commit e8d3efa1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104117 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-104117?: Check whether you run Illumos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: illumos-gate commit e8d3efa1

Technical details

The ipmgmtd door dispatch table fails to require the solaris.network.interface.config authorization for the IPMGMT_CMD_IPMP_UPDATE command. An attacker with local access can exploit this to call ipmgmt_ipmp_update_handler() with the IPMGMT_PERSIST flag set, allowing persistent modification of IPMP group membership in stored configuration. The running system is unaffected until the configuration is reapplied.

Affected products

illumos illumos prior to commit e8d3efa1

Timeline

2026-10-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.