EUVD-2026-58393
GHSA-fvvg-h3g4-94gm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network vector is consistent with description; AC:H reflects non-trivial preconditions; PR:L reflects mandatory prior authentication; integrity-only low impact aligns with a privilege bypass that does not achieve full control.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper privilege management.
AnalysisAI
Privilege management bypass in IBM i 7.3 through 7.6 permits remote low-privilege authenticated attackers to circumvent security restrictions and achieve limited unauthorized integrity modifications. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms network reachability but imposes high attack complexity and mandatory prior authentication, significantly constraining the realistic attack surface. No public exploit code and no CISA KEV listing were identified at time of analysis, consistent with the low base score and high complexity requirement.
Technical ContextAI
IBM i (formerly AS/400 and iSeries) is IBM's proprietary integrated operating system for IBM Power Systems midrange hardware, extensively deployed in financial services, manufacturing, insurance, and retail industries. The affected product range spans versions 7.3, 7.4, 7.5, and 7.6 per CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*. The root cause is CWE-269 (Improper Privilege Management), a vulnerability class where a system fails to correctly enforce privilege boundaries - typically through insufficient authorization checks in a privileged system interface, command processor, or network-accessible API - allowing a lower-privileged caller to invoke capabilities reserved for higher-privileged roles. The network attack vector (AV:N) suggests the flaw resides in one of IBM i's network-accessible services or middleware components rather than requiring local console or operator access.
RemediationAI
IBM has released a patch addressing this vulnerability; the advisory is published at https://www.ibm.com/support/pages/node/7283572. Organizations running IBM i 7.3, 7.4, 7.5, or 7.6 should apply the vendor-supplied fix through IBM's standard PTF (Program Temporary Fix) distribution mechanism. The exact PTF number or fix build identifier is not independently confirmed from available data - consult the IBM advisory directly for version-specific PTF identifiers before applying. As a compensating control pending patch application, restrict network access to IBM i administrative and privileged interfaces using network segmentation or IBM i's built-in IP packet rules filtering (configurable via IBM Access Client Solutions or Navigator for i); note that overly broad interface restrictions may affect legitimate administrative workflows and should be coordinated with operations and application teams before implementation. Additionally, audit low-privilege user profiles for anomalous privilege assignments or unexpected authority grants as a detective measure.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today