EUVD-2026-71486
GHSA-qmwp-q4j7-m4gp
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Local access and high privileges required to access key-obfuscation internals; only confidentiality impacted as keys are read, not modified.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to the use of hardcoded cryptographic constants to obfuscate encryption keys.
AnalysisAI
IBM i versions 7.3 through 7.6 expose encryption key material to high-privileged local users due to hardcoded cryptographic constants used in the key-obfuscation layer. An attacker with elevated local privileges can leverage knowledge of these constants to reverse the obfuscation and recover plaintext encryption keys, gaining access to data that was assumed to be cryptographically protected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active session on the IBM i system with high special authorities (equivalent to *ALLOBJ or *SECADM). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N = 4.4 Medium) accurately reflects the constrained threat model: exploitation is strictly local and requires high administrative privileges, substantially limiting the attacker pool to insiders or accounts already fully compromised. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the PTFs (Program Temporary Fixes) provided by IBM via the advisory at https://www.ibm.com/support/pages/node/7285846 for the relevant IBM i release (7.3, 7.4, 7.5, or 7.6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today