{"schema":"threatline.record/2","record":{"id":"CVE-2026-104117","aliases":[],"summary":"Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership","details":"A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c does not require the solaris.network.interface.config authorization for the IPMGMT_CMD_IPMP_UPDATE command, although its handler, ipmgmt_ipmp_update_handler(), writes to the persistent ipadm configuration when the IPMGMT_PERSIST flag is set. An unprivileged local user can therefore add interfaces to, or remove them from, existing IPMP groups in the stored configuration. The running configuration is not changed; the modification takes effect when the stored configuration is next applied, such as at boot, and may disrupt network connectivity. The flaw has existed since 2021 (illumos-gate commit a73be61a), and affects any illumos distribution prior to illumos-gate commit e8d3efa1.","categories":["Unclassified"],"product":"illumos-gate","vendor":"illumos","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104117","source_modified_at":"2026-10-09T16:45:59.398Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"illumos-gate","vendor":"illumos","versions":[{"status":"affected","version":"a73be61a80f7331c35adfa540bcf8f1546ff1e33","lessThan":"e8d3efa1c56e5f2b5368600a2baeb7b1d54a07f8","changes":[{"at":"e8d3efa1c56e5f2b5368600a2baeb7b1d54a07f8","status":"unaffected"}],"versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104117","source_modified_at":"2026-10-09T16:45:59.398Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"OmniOS","vendor":"OmniOS","versions":[{"status":"affected","version":"r151042","lessThan":"r151054","versionType":"custom"},{"status":"affected","version":"r151058","lessThan":"r151058w","changes":[{"at":"r151058w","status":"unaffected"}],"versionType":"custom"},{"status":"affected","version":"r151056","lessThan":"r151056aw","changes":[{"at":"r151056aw","status":"unaffected"}],"versionType":"custom"},{"status":"affected","version":"r151054","lessThan":"r151054bw","changes":[{"at":"r151054bw","status":"unaffected"}],"versionType":"custom"}],"defaultStatus":"affected"}],"fixed_versions":[],"cvss":1.9,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00106,"percentile":0.01075,"score_date":"2026-10-23"},"published_at":"2026-10-09T14:15:42.585Z","modified_at":"2026-10-09T16:45:59.398Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-104117","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-09T16:45:59.398Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104117","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://illumos.topicbox.com/groups/developer/T3b859664594b7762/cve-2026-104112-to-cve-2026-104117-denial-of-service-and-missing-authorization-in-door-servers","tags":["mailing-list"]},{"source":"CVE List","url":"https://illumos.org/issues/18492","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/illumos/illumos-gate/commit/e8d3efa1c56e5f2b5368600a2baeb7b1d54a07f8","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-09T16:15:22.781812Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-09T16:45:59.398Z","content_hash":"82979a133f90c5493d7b69c505cdcf3c431fed1f812c99eb162a50c43e5c4384"}}