EUVD-2026-58455
GHSA-gpv8-v95v-wfmm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Local attack vector and low-privilege requirement are confirmed by description; no availability impact and no scope change are apparent from the flaw class.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management.
AnalysisAI
Improper privilege management in IBM i 7.3, 7.4, 7.5, and 7.6 enables a locally authenticated low-privileged attacker to read sensitive information or alter data beyond their authorized scope. The flaw is rooted in CWE-269 and carries a CVSS 3.1 score of 4.4 (Medium), reflecting its local-only attack vector and limited impact. No public exploit code and no confirmed active exploitation have been identified at time of analysis; a vendor-released patch is available.
Technical ContextAI
IBM i (formerly AS/400 and iSeries) is IBM's integrated, vertically-stacked operating platform common in mid-range enterprise and government environments, particularly for ERP, financial, and database workloads. The affected CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* spans all sub-versions of IBM i 7.3 through 7.6. CWE-269 (Improper Privilege Management) identifies the root cause as a failure in the system's mechanism for assigning, verifying, or enforcing privilege boundaries - allowing a lower-privileged local user to exceed their authorized access level. This class of flaw often manifests in setuid binaries, object-level authority misconfigurations on IBM i's object-based architecture, or insufficient separation of special authorities such as *ALLOBJ or *SECADM.
RemediationAI
The primary remediation is to apply the vendor-released patch referenced in IBM's security advisory at https://www.ibm.com/support/pages/node/7283273. Administrators should consult that advisory for the specific PTF numbers applicable to each IBM i release level (7.3, 7.4, 7.5, 7.6) and apply them through normal IBM i PTF management procedures. As a compensating control prior to patching, restrict interactive sign-on and SSH/FTP access to IBM i partitions to only those users with a documented business need, and audit adopted authority and setuid-equivalent object permissions using DSPOBJAUT and PRTUSRPRF. Enable IBM i security auditing (QAUDLVL) to log authority failures, which will surface exploitation attempts. These controls reduce the attack surface but do not eliminate the underlying privilege management flaw and should not substitute for patching.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today