CVE-2026-104114

A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a request was supplied, and before checking the caller's credentials. Because the nwamd door at /etc/svc/volatile/nwam/nwam_door is accessible to all local users, an unprivileged user can issue a door_call() with no argument data to crash nwamd; repeated calls place the svc:/network/physical:nwam service into maintenance, stopping automatic network configuration. nwamd runs only when svc:/network/physical:nwam is enabled, which is not the default. The flaw has existed since 2010 (illumos-gate commit 6ba597c5), and affects any illumos distribution prior to illumos-gate commit 0f1064d9.

• CWE-476

• https://github.com/illumos/illumos-gate/commit/0f1064d97f1a43778ddf87d4e438b99872aed1a0
• https://illumos.org/issues/18495
• https://illumos.topicbox.com/groups/developer/T3b859664594b7762/cve-2026-104112-to-cve-2026-104117-denial-of-service-and-missing-authorization-in-door-servers

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104081KodExplorer before 4.55 contains a path traversal vulnerabil…8.1
• CVE-2026-104082SmarterMail before build 9777 contains a remote code executi…7.2
• CVE-2026-104083SmarterMail before build 9777 contains a stored mutation cro…6.1
• CVE-2026-104084SmarterMail before build 9777 contains a privilege escalatio…8.8
• CVE-2026-104112A missing release of resources in the illumos name service c…6.8
• CVE-2026-104113A double free in the IP management daemon (ipmgmtd) of OmniO…5.4
• CVE-2026-104115A stack-based buffer overflow in the illumos reparse point d…5.4
• CVE-2026-104116A missing authorization check in the illumos zones statistic…1.9
• CVE-2026-104117A missing authorization check in the illumos IP management d…1.9
• CVE-2026-104118The Razorpay for WooCommerce WordPress plugin before 4.8.8 d…5.3
• CVE-2026-104119The Simple Shopping Cart WordPress plugin before 5.2.6 does …3.5
• CVE-2026-104120A security vulnerability has been detected in modelcontextpr…7.3