EUVD-2026-98167
GHSA-5frj-2gjj-w54h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IBM i sign-on service remotely
-
ExploitSubmit candidate user profile names
-
ExecutionObserve distinct error codes per profile
-
ImpactEnumerate valid accounts for targeting
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to an IBM i sign-on interface and relies on the system returning distinct error codes for existing versus non-existent user profiles during authentication; the attacker needs no credentials and no user interaction (PR:N/UI:N). The practical limiting factors are: the sign-on service must be network-exposed to the attacker (many IBM i deployments restrict these interfaces to internal/management networks or behind VPNs), and the impact is confined to account enumeration - the flaw yields no password, no code execution, and no data beyond confirmation of valid profile names. Affected releases are IBM i 7.3, 7.4, 7.5, and 7.6. |
| Impact | This is a genuine-but-low-priority information disclosure issue, not a critical flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability against the sign-on process, which raises its relative concern, but the impact is narrow: C:L/I:N/A:N means only limited confidentiality loss (the ability to confirm whether a given user profile exists) with no integrity or availability impact - hence the modest 5.3 base score. No EPSS probability was provided in the input, so exploitation likelihood cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code was supplied, so there is no public exploit identified at time of analysis. The SSVC/technical-impact signal is 'partial' at best: this is an enumeration primitive that aids reconnaissance (feeding later brute-force or password-spray campaigns) rather than a standalone compromise. Realistically this is a high-reachability, low-direct-impact issue - a hardening/defense-in-depth fix rather than an emergency patch - and no signals conflict with that reading. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker repeatedly submits sign-on attempts to an exposed IBM i service and observes that the system returns distinct error codes for valid versus invalid user profiles. By iterating through a wordlist of candidate names, the attacker compiles a list of confirmed valid profiles to target in a follow-on password-spraying or brute-force campaign. No public exploit code is required - the attack relies only on observing differential responses. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
User profile enumeration in IBM i 7.3, 7.4, 7.5, and 7.6 allows unauthenticated remote attackers to determine which user profiles exist by observing distinct error codes returned during the sign-on process. The issue requires only network reachability to an exposed IBM i sign-on interface - no credentials and no user interaction (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N, C:L only) - and yields nothing beyond confirmation of valid profile names, so it is a reconnaissance weakness rather than a compromise vector. No public exploit code has been identified at time of analysis, the vulnerability is not listed in CISA KEV, and IBM has published a fix.
RemediationAI
IBM has released a fix for this issue; apply the PTFs documented in IBM's advisory at https://www.ibm.com/support/pages/node/7290096 to IBM i 7.3, 7.4, 7.5, and 7.6 systems - patch status is 'available per vendor advisory,' and the exact PTF numbers and cumulative levels should be confirmed against that page and verified on the system (for example, by reviewing installed PTF groups) before considering the exposure closed. Until patching is complete, the most effective compensating control is to reduce reachability: restrict the sign-on interfaces that return the differentiating errors - 5250/telnet, FTP, and DRDA-style connections - to trusted management networks or VPN-only access, and block them at the perimeter; the trade-off is that legitimate remote users and integration jobs lose direct access and must be routed through the restricted path. Administrators can also tighten IBM i sign-on system values that govern sign-on information display and the handling of repeated failures so that less information is returned and brute-force/enumeration attempts are throttled, at the cost of some user-visible sign-on detail and potential lockouts of legitimate accounts. Finally, enable and monitor security auditing (QAUDJRN) for bursts of sign-on failures across many different profile names, which is the signature of the enumeration this CVE enables; this detects rather than prevents the issue and depends on timely log review.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an information exposure (CWE-200) rooted in an authentication oracle: the IBM i sign-on path returns distinguishable error responses for a non-existent user profile versus an existing profile with bad credentials, letting an attacker script requests and harvest a list of valid profile names. Because IBM i serves many entry points that ultimately validate the same user profile objects - 5250/telnet sign-on, IBM i Access Client Solutions, FTP, and DDM/DRDA-style connections - the differentiating behavior can surface wherever the sign-on exchange is exposed over the network. The CPE record (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) confirms the affected component is the IBM i operating system itself across the 7.3-7.6 release family rather than a bolt-on product, so remediation is delivered through IBM i PTFs. The weakness is single-boundary (S:U) and read-only (no I or A impact); its value to an attacker is purely as a precursor - harvested profile names shrink the search space for password guessing, credential stuffing, or social engineering against a platform whose privileged profiles (QSECOFR, QSECOFR-class service accounts) are well-known targets. It is also effectively silent, since enumeration traffic looks like ordinary failed sign-on attempts unless audit journaling and monitoring are in place.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote unauthenticated enumeration via the sign-on process gives AV:N/AC:L/PR:N/UI:N; only limited profile-existence disclosure gives C:L with I:N/A:N.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB