EUVD-2026-57361
GHSA-jhv9-vcr5-22m6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege IBM i profile
-
DeliveryReach vulnerable high-authority thread handling
-
ExploitTrigger improper authorization check
-
ExecutionExecute actions with elevated authority
-
ImpactCompromise data and system across scope boundary
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must already be authenticated to the IBM i system with a low-privilege user profile (CVSS PR:L) and have network reachability to the affected service - this is a post-authentication local-to-system privilege escalation, not anonymous RCE. The specific technical prerequisite named by IBM is the improper authorization in the handling of high-authority threads, so exploitation depends on interacting with that high-authority thread mechanism. Limiting factors: valid credentials are required (no PR:N unauthenticated path), only releases 7.3-7.6 are affected, and SSVC assesses the flaw as not automatable, indicating exploitation is not trivially scalable; no user interaction is needed once a foothold exists. |
| Impact | The signals are mixed and should be read together. CVSS 9.9 with AV:N/AC:L/PR:L/UI:N/S:C reflects that an already-authenticated, low-privilege user can, over the network with low complexity and no user interaction, cross a privilege boundary and achieve total impact - CISA's SSVC framing agrees on Technical Impact: total. However, SSVC records Exploitation: none and Automatable: no, EPSS is only 0.24% (16th percentile), and there is no KEV listing or known POC, which tempers the urgency: this is a serious latent risk rather than a mass-exploited emergency. The critical caveat is the PR:L prerequisite - an attacker must first hold valid low-privilege credentials on the system, so this is a post-authentication escalation, most dangerous on IBM i hosts with many user profiles, weak credential hygiene, or exposed sign-on services. Given total impact and an available patch, any organization running affected releases should prioritize patching promptly even though widespread automated exploitation is not indicated. |
| Exploit ScenarioDerived | An attacker who has obtained or been issued a low-authority IBM i user profile (for example a limited application or interactive user) connects over the network and triggers the flawed high-authority thread handling to run operations with elevated authority. With no user interaction and low attack complexity, they escalate to broad system authority and can read or alter sensitive business data and libraries; no public exploit code is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 13, 2026
Privilege escalation in IBM i (formerly OS/400) releases 7.3 through 7.6 lets a remote authenticated user with low privileges gain higher, potentially all-object, authority by abusing improper authorization checks in the handling of high-authority threads. The flaw is scored CVSS 9.9 because of a scope change (S:C) that lets a foothold on the platform lead to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and EPSS is low at 0.24%, but a vendor patch is available.
Earlier versions of this analysis (1)
Privilege escalation in IBM i (the operating system for IBM Power / AS/400-lineage midrange systems) versions 7.3, 7.4, 7.5, and 7.6 allows a remote authenticated attacker with low privileges to gain high-authority capabilities through improper authorization when handling high-authority threads. The scope-changing flaw (CVSS 9.6) lets a low-privileged user break out of their authority boundary and read or modify resources beyond their assigned rights. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high base score and authenticated-only requirement make it a strong internal-threat and post-compromise priority.
RemediationAI
Patch available per vendor advisory: apply the fixes referenced in IBM support document https://www.ibm.com/support/pages/node/7283292 for your specific IBM i release (7.3, 7.4, 7.5, or 7.6) - exact PTF/PTF-group levels are not enumerated in the available data, so confirm the current level from that page before deploying. Because exploitation requires an authenticated low-privilege foothold, effective compensating controls while scheduling the patch include tightening user-profile provisioning and removing unnecessary special authorities, enforcing least privilege and strong credential/MFA policies on sign-on services, restricting network reachability of IBM i host services to trusted management networks (reducing the AV:N exposure), and increasing audit/journal monitoring (QAUDJRN) for unexpected authority use - with the trade-off that these reduce but do not eliminate risk since the escalation path itself remains until the PTF is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM i is IBM's integrated midrange operating environment (running on Power Systems, historically AS/400) used for core business and ERP workloads, identified here by cpe:2.3:a:ibm:i. The root cause is CWE-269 (Improper Privilege Management): when the OS spawns or manages threads that run under elevated (high) authority, the authorization boundary between the calling user's profile and the privileged thread is not enforced correctly. In IBM i's authority model, user profiles carry special authorities (e.g. *ALLOBJ, *SECADM); a thread that improperly retains or exposes high authority allows a low-authority profile to execute actions with privileges it was never granted, effectively bypassing object-level and adopted-authority controls.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated low-privilege user (PR:L) escalates over the network with low complexity; improper authority crosses a security boundary (S:C) yielding total C/I/A impact.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority threads.
Executive ViewAI
IBM i systems running releases 7.3 through 7.6 are vulnerable to privilege escalation that enables any authenticated user to gain full system authority, creating risk of complete data compromise and operational disruption. This CVSS 9.9 vulnerability bypasses authorization controls on high-privilege threads, allowing attackers to escalate from low-privilege accounts to unrestricted access across all system objects and resources. Immediate action is required for any IBM i environments supporting business-critical operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB