illumos ipmgmtd EUVD-2026-95798

Requires an interactive local account on an illumos distribution (OmniOS or other illumos-gate derivative) running a build prior to commit e8d3efa1; the attacker must be able to reach the ipmgmtd door and issue IPMGMT_CMD_IPMP_UPDATE with the IPMGMT_PERSIST flag. To cause meaningful disruption the host must already have configured IPMP groups in its persistent ipadm store. Limiting factors that reduce real-world risk: no remote vector (AV:L, local only), an authenticated local user is required (PR:L, not PR:N), and the modification does NOT affect the running configuration - it only takes effect when the stored config is next applied, typically at reboot, so impact is delayed rather than immediate.

This is a genuinely low-priority issue, and the available signals agree. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores 1.9 (Low): exploitation is purely local (AV:L) and requires an existing local account (PR:L), so there is no remote or unauthenticated exposure. Impact is constrained - VC:N (no confidentiality loss), with only VI:L and VA:L, and critically the running configuration is not altered; disruption only manifests when the stored configuration is next applied (e.g., at reboot), making the effect delayed and detectable rather than immediate. The input lists no CISA KEV status and no EPSS probability, so there is no evidence of widespread or active exploitation. One point to flag explicitly: the CVSS 4.0 vector carries E:P (Exploit maturity = Proof-of-Concept), which implies PoC-level code may exist, yet the multi-source intelligence provides no separate POC flag and no public exploit is cataloged - these signals are consistent with a low-risk, local-only authorization gap, not an urgent threat.

A logged-in, unprivileged local user on an illumos-based host (e.g., OmniOS) invokes the ipmgmtd door with the IPMGMT_CMD_IPMP_UPDATE command and the IPMGMT_PERSIST flag, adding or removing interfaces in an existing IPMP group within the stored ipadm configuration. The change is silent and the live system keeps working, but at the next boot the corrupted persistent config is applied and network connectivity is disrupted. No public exploit is explicitly identified, though the CVSS vector's E:P suggests proof-of-concept maturity.