EUVD-2026-103140
GHSA-qxxp-9265-8h46
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged IBM i user
-
ExploitSubmit crafted file handle bypassing subtree check
-
ImpactRead sensitive files outside authorized scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated local/low-privileged account on an affected IBM i release (7.3, 7.4, 7.5, or 7.6), per PR:L in the vendor CVSS vector. The specific trigger is file handle resolution lacking subtree checks - consistent with NFS-style export/file-handle handling - so exploitation is tied to environments where such file-handle resolution is reachable by the attacker. Limiting factors: authentication is required (not remote-unauthenticated), impact is confined to reading sensitive information (no integrity/availability effect per the description), and only the enumerated IBM i versions are in scope; the 'local attacker' wording further suggests an existing foothold is needed despite the vendor's AV:N rating. |
| Impact | Signals are mixed and point to a moderate, not urgent, priority. IBM's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N = 5.4 Medium) claims a network attack vector, but the description explicitly states a 'local attacker' - this is a direct conflict that must be resolved with the vendor; 'missing subtree checks during file handle resolution' is classic NFS-style file-handle/subtree-check behavior, which can be network-facing (NFS) yet require a local authenticated foothold, so AV:N may be defensible even though the prose reads as local. No EPSS score, KEV listing, or POC was provided, so exploitation likelihood cannot be quantified from the inputs. Exploitation status: no public exploit identified at time of analysis. Impact is limited - low confidentiality (and per IBM, low integrity), no availability impact, requiring an authenticated low-privileged actor (PR:L). Net: a real but modest access-control/information-disclosure weakness that warrants patching in normal cycles rather than emergency response, pending vendor clarification of the AV:N-versus-'local' contradiction. |
| Exploit ScenarioDerived | An authenticated low-privileged user on an affected IBM i system (7.3-7.6) crafts or resolves a file handle that, due to missing subtree checks, references files outside the directory subtree they are authorized to access, letting them read sensitive information belonging to other users or the system. No public exploit code is known, and the low attack complexity (AC:L) means a knowledgeable local user could trigger it reliably once authenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
IBM i releases 7.3, 7.4, 7.5, and 7.6 can disclose sensitive information to a local attacker who already holds an authenticated low-privileged account, because file handle resolution omits necessary subtree checks and therefore fails to enforce the directory hierarchy boundary. The vendor CVSS vector rates the issue at 5.4 (network-vector, PR:L), but the independent assessment re-scopes it to a local attack (AV:L) with confidentiality-only impact, meaning an attacker needs an existing foothold on the system rather than unauthenticated remote access. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); EPSS data was not provided, so risk is best treated as moderate with a low likelihood of mass exploitation and a higher payoff for an insider or post-compromise attacker seeking data outside their authorized subtree.
RemediationAI
Apply the fix published through the vendor advisory at https://www.ibm.com/support/pages/node/7292423; the input records patch status as 'Available from vendor', so remediation is expected via IBM i program temporary fixes (PTFs) for the applicable release level - no exact fix version or PTF number is present in the provided data, so the specific PTF identifiers must be read from that advisory and applied per release (7.3, 7.4, 7.5, 7.6). Because the independent assessment finds this requires an authenticated local/low-privileged account, the most effective compensating controls are privilege and exposure reduction: restrict and audit which users and profiles can reach file-handle resolution paths, and where those paths are exposed through file-sharing or export services, limit them to trusted hosts and networks and remove broad or world-reachable exports. Tightening export/subtree configuration reduces the attack surface but risks breaking legitimate cross-directory access for applications that relied on the previous permissive resolution, so validate dependent workloads before enforcing. Additionally, enforce least privilege so that no interactive or batch profile holds more filesystem authority than its function requires, and monitor for anomalous reads of files outside a user's expected subtree, since such reads are the clearest detection signal for exploitation of missing subtree checks. As always in this environment, treat patching as the primary control and the above as interim hardening while PTFs are staged.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-284 (Improper Access Control): during resolution of a file handle, the implementation does not verify that the handle falls within an authorized subtree before honoring it. This pattern is characteristic of file-handle-based access paths, such as NFS-style export and filehandle handling, where a handle that encodes a location is trusted without re-validating the containing export root or directory ancestry. Where such checks are missing, an attacker able to submit or reuse handles can traverse outside the intended directory boundary and read files they should not reach - an access-control bypass rather than a memory-safety flaw, which is consistent with the supplied tags ('Authentication Bypass', 'IBM') describing circumvention of an authorization boundary. The CPE string provided is fully wildcarded (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*), so the CPE alone does not narrow the affected versions; the scoping instead comes from the vendor statement covering IBM i 7.3, 7.4, 7.5, and 7.6. The vendor vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and the independent vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) agree on low complexity, required privileges (PR:L), no user interaction, and unchanged scope; they diverge on attack vector (network vs. local) and on whether integrity is affected. The independent assessment treats the impact as confidentiality-only, which aligns with the description's singular focus on obtaining sensitive information and with the absence of any stated write, corruption, or denial-of-service effect.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description states a local authenticated attacker, so AV:L and PR:L with AC:L; only sensitive-information disclosure is described, giving C:L with I:N/A:N.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB