A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config authorization for the IPMGMTCMDIPMPUPDATE command, although its handler, ipmgmtipmpupdatehandler(), writes to the persistent ipadm configuration when the IPMGMTPERSIST flag is set. An unprivileged local user can therefore add interfaces to, or remove them from, existing IPMP groups in the stored configuration. The running configuration is not changed; the modification takes effect when the stored configuration is next applied, such as at boot, and may disrupt network connectivity. The flaw has existed since 2021 (illumos-gate commit a73be61a), and affects any illumos distribution prior to illumos-gate commit e8d3efa1.

Per https://illumos.topicbox.com/groups/developer/T3b859664594b7762-Maa764f8552227c7080bcaabc/cve-2026-104112-to-cve-2026-104117-denial-of-service-and-missing-authorization-in-door-servers illumos would like to report the following CVEs:

CVE-2026-104112 18494 nscd: unbounded file descriptor allocation

CVE-2026-104113 ipmgmtd double-frees caller credentials on authorization failure (OmniOS and SmartOS only, no general illumos issue)

CVE-2026-104114 18495 Empty nwamd Door payload allows Denial of Service

CVE-2026-104115 18496 Unauthenticated Stack Overflow in reparsed

CVE-2026-104116 18493 Missing doorucred Check in zonestatd

CVE-2026-104117 18492 Missing Authorization in ipmgmtd Allows IPMP Reconfiguration

These were all discovered by Robert French and James Wynne III.

Thank you, Dan McDonald, on behalf of illumos security