EUVD-2026-58399
GHSA-94qj-cpvx-mwwc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IBM i network service
-
DeliveryDeliver crafted request/lure
-
ExploitInduce user interaction
-
ExecutionBypass authentication check
-
ImpactExecute code or read sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the affected IBM i service and a legitimate user/operator to interact with attacker-supplied input (CVSS UI:R) - the attack does not succeed fully autonomously, which is what limits it (SSVC Automatable: no). No pre-existing credentials or privileges are needed on the target per PR:N. The available data does not name the exact IBM i feature, service, or configuration that carries the improper-authentication weakness, so the precise vulnerable component and any non-default-configuration requirement cannot be confirmed from the input and should be verified against the IBM advisory (node 7283292). Primary limiting factors: required user interaction and network access to the specific IBM i service. |
| Impact | The signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) implies a network-reachable, low-complexity, unauthenticated bypass with total confidentiality/integrity/availability impact and a scope change - a severe profile - but it requires user interaction (UI:R), which lowers automatability. This aligns with CISA's SSVC read: Exploitation 'none', Automatable 'no', Technical Impact 'total'. EPSS is low (0.41%, 34th percentile) and the CVE is not in KEV, so despite the critical score there is no evidence of active or widespread exploitation today. The score is largely vendor-asserted (reported by IBM); the description is generic and does not explain the authentication weakness, so the CVSS scope-change and true attack surface cannot be independently verified from the provided data. Net: a high-priority patch item for IBM i shops given total technical impact, but current real-world exploitation risk is low and gated by required user interaction. |
| Exploit ScenarioDerived | A remote attacker crafts a malicious request or lure and gets an IBM i user or operator to interact with it (UI:R); the improper authentication flaw lets the attacker be treated as an authenticated party, after which they execute arbitrary code or read sensitive data on the system. With AV:N/AC:L the network delivery is straightforward, though the required user interaction limits opportunistic mass exploitation; no public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 19, 2026
Improper authentication in IBM i (IBM's integrated midrange operating system, formerly OS/400) versions 7.3, 7.4, 7.5 and 7.6 allows a remote attacker to bypass authentication controls to execute arbitrary code or read sensitive data, provided a legitimate user is induced to interact (UI:R). IBM has published a fix (support node 7283292) and rates it 9.6 critical; there is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS score of 0.41% (34th percentile) indicating no observed mass exploitation yet.
Earlier versions of this analysis (1)
Remote code execution and sensitive information disclosure in IBM i versions 7.3 through 7.6 arise from improper authentication (CWE-287), allowing unauthenticated network-based attackers to bypass identity verification under specific conditions. The CVSS scope change (S:C) signals that successful exploitation can extend impact beyond the initially compromised component to downstream systems - a notable amplifier in environments where IBM i hosts mission-critical financial and operational workloads. No public exploit identified at time of analysis, but a vendor-released patch is available via IBM's security advisory.
RemediationAI
Apply the IBM-supplied fix documented at https://www.ibm.com/support/pages/node/7283292 (patch available per vendor advisory) across all affected releases 7.3, 7.4, 7.5 and 7.6 by installing the corresponding IBM i PTFs/Group PTF levels referenced in that advisory; exact fix version numbers are not provided in the input, so pull them directly from the IBM support page. Because exploitation requires user interaction over the network, until PTFs are applied reduce exposure by restricting network reachability of IBM i host servers and TCP/IP services to trusted management networks (firewall/allow-list to the affected daemons), disabling unused network servers, and enforcing least privilege - noting the trade-off that tightening host-server access may disrupt client applications (e.g., ODBC/JDBC, Navigator, host-server-dependent tooling). Given UI:R, also counsel operators against interacting with untrusted requests/content directed at the system. Do not treat these as substitutes for the PTFs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM i is the object-based operating system running on IBM Power Systems (historically AS/400 / iSeries), widely used for ERP, banking and manufacturing workloads and reachable over network services such as host servers, TCP/IP daemons and web/application interfaces. The root cause is CWE-287 (Improper Authentication), meaning an identity- or credential-verification step can be bypassed or spoofed, allowing an actor to be treated as an authenticated principal without valid credentials. The single generic CPE (cpe:2.3:a:ibm:i:*) does not identify which specific IBM i subsystem or licensed program contains the flaw, so the exact affected component is not disclosed in the available data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network, low-complexity, unauthenticated auth bypass needing user interaction (UI:R) with full code-exec/data impact; scope set U as the generic description gives no evidence of a cross-boundary change.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.
Executive ViewAI
IBM i integrated systems (versions 7.3-7.6) face a critical authentication bypass vulnerability (CVSS 9.6) enabling remote code execution and sensitive data access when users interact with attacker-crafted inputs. Organizations relying on IBM i for core business operations face risk of system compromise and data breach; mitigation requires vendor patch deployment across all affected instances.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB