illumos has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 6. The median CVSS is 5.4 (medium). None have a confirmed exploitation report. Most affected products: SUNWcs (3), service/file-system/nfs (1), system/bhyve (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Products
- SUNWcs 3
- service/file-system/nfs 1
- system/bhyve 1
- system/zones 1
Worst active — by depth score
CVE-2026-104112Medium· 6.8A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory37CVE-2026-102916Medium· 6.8A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host37CVE-2026-104115Medium· 5.4A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon30CVE-2026-104114Medium· 5.4A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon30CVE-2026-104117Low· 1.9A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration10
illumos vulnerabilities
CVEs affecting illumos, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-104117Low· 1.9A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration
A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_doo…
CVE-2026-104116Low· 1.9A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running
A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsd_server…
CVE-2026-104115Medium· 5.4A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon
A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in usr/src/cmd/fs.d/nfs/rp_basic/libnfs_basic.c, part of the nfs-basic reparse plugin, copies the ho…
CVE-2026-104114Medium· 5.4A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon
A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking…
CVE-2026-104112Medium· 6.8A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory
A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door server procedure, switcher() in usr/src/cmd/nscd/nscd_frontend.c, does not close file descriptors …
CVE-2026-102916Medium· 6.8A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host
A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/i…