EUVD-2026-58389
GHSA-2pm2-c9xh-qfxq
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Low-privilege authentication (PR:L) required; no victim interaction needed for token bypass; no availability impact from CSRF exploitation.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens.
AnalysisAI
Improper anti-CSRF token validation in IBM i 7.3 through 7.6 enables remote authenticated attackers to bypass CSRF security controls, resulting in high confidentiality and integrity compromise (CVSS 8.1). The flaw is rooted in the server's failure to correctly validate CSRF tokens on state-changing requests, allowing a low-privileged authenticated attacker to forge or replay requests without victim interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with at least low-privilege credentials on the target IBM i system (confirmed by CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 High score is driven by network-accessible attack vector (AV:N), low complexity (AC:L), low-privilege requirement (PR:L), and high confidentiality and integrity impact (C:H/I:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | IBM has released a patch addressing this vulnerability; apply the fix detailed in IBM support advisory 7283569 at https://www.ibm.com/support/pages/node/7283569. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all IBM i systems running versions 7.3-7.6 and classify by business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today