EUVD-2026-71482
GHSA-48hc-r2hp-8cx3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed IBM i service over network
-
DeliveryInvoke critical function without authentication
-
ExploitBypass absent auth check (CWE-306)
-
ExecutionTrigger DoS or unauthorized data modification
-
ImpactBusiness disruption and integrity loss
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the vulnerable IBM i service exposing the critical function - no authentication, no user interaction, and no non-default configuration are indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). No special conditions beyond reaching the affected service on IBM i 7.3-7.6. The primary limiting factor is network exposure: environments that segment IBM i management/service ports away from untrusted networks materially reduce reachability, and the impact is confined to integrity and availability (no confidentiality loss per C:N). |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (9.1 Critical) describes a low-complexity, remote, unauthenticated attack with high integrity and availability impact but no confidentiality exposure - internally consistent with a missing-authentication DoS/tamper flaw. However, the signals diverge on urgency: EPSS is only 0.36% (29th percentile) and the CVE is not in CISA KEV, so despite the high base score there is no evidence of active or imminent mass exploitation. There is no public POC identified. In practice this is a high-severity issue that should be patched on IBM i's normal risk cadence but does not currently show the exploitation velocity of a drop-everything emergency. Note the SSVC/automatable and detailed technical-impact fields are not provided in the input, so exploitability nuance beyond CVSS could not be fully assessed. |
| Exploit ScenarioDerived | An attacker with network reach to an exposed IBM i system sends a request directly to the affected critical function, which processes it without ever requiring authentication. The attacker either forces the service into a denial-of-service condition or alters data/state it controls, disrupting business operations without needing any valid credentials; no public POC is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 08, 2026
Remote denial of service and data integrity compromise in IBM i (formerly OS/400) releases 7.3, 7.4, 7.5, and 7.6 stems from a critical function that ships without an authentication check (CWE-306), letting a network attacker invoke it without credentials. IBM has released a fix, and no public exploit has been identified at time of analysis; EPSS is low at 0.36% (29th percentile), indicating no observed exploitation pressure yet.
Earlier versions of this analysis (1)
Unauthenticated remote exploitation of IBM i 7.3 through 7.6 exposes critical functions without authentication checks, enabling network attackers to degrade availability and corrupt data integrity. The root cause is CWE-306 (Missing Authentication for Critical Function), where specific network-accessible functions can be invoked without credentials, directly resulting in denial-of-service conditions and limited data integrity violations. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; IBM has released a patch via the referenced advisory.
RemediationAI
Apply the IBM-provided fix per the vendor bulletin at https://www.ibm.com/support/pages/node/7285847 (Patch available per vendor advisory), which supplies PTFs/Group PTF updates for the supported IBM i 7.3, 7.4, 7.5, and 7.6 releases - apply the correct PTF level for your installed release. The input does not include a discrete fix build string, so use the exact PTF identifiers listed in that bulletin rather than an inferred version. As a compensating control until the PTF is loaded, restrict network reachability to the affected IBM i service by firewalling or ACL-limiting access to trusted management hosts/subnets only; the trade-off is that legitimate remote clients of that function will also be blocked, so validate which ports/services the bulletin identifies before restricting. Because the flaw affects integrity and availability, also increase monitoring and back up critical libraries so tampering or a DoS event can be detected and recovered.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM i is IBM's integrated midrange operating system running on Power Systems hardware, widely used for business-critical ERP, banking, and manufacturing workloads. The root cause is CWE-306 (Missing Authentication for a Critical Function): a network-reachable function that performs a security-relevant operation does not verify the caller's identity before acting. The affected component is identified by CPE cpe:2.3:a:ibm:i across all supported releases (7.3 through 7.6). Because the missing check is on the function itself rather than a bypassable auth layer, any party able to reach the service endpoint can drive it, producing both availability loss and unauthorized state changes.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Missing authentication makes it network-reachable and unauthenticated (AV:N/AC:L/PR:N/UI:N); impact is integrity and availability with no confidentiality exposure (C:N/I:H/A:H).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and affect data integrity due to missing authentication for critical functions.
Executive ViewAI
IBM i operating system versions 7.3 through 7.6 contain a critical unauthenticated vulnerability enabling remote attackers to disrupt business operations and compromise data integrity without valid credentials. Organizations running IBM i should immediately assess exposure and prioritize patching to eliminate risk of network-based service disruptions and data corruption affecting mission-critical systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB