EUVD-2026-71607
GHSA-7wjh-qq66-9589
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IBM i auth service over network
-
DeliverySubmit crafted authentication parameters
-
ExploitBypass improper credential validation
-
ExecutionObtain unauthorized authenticated session
-
ImpactAccess/modify system data and functions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the affected IBM i authentication service and the ability to submit manipulated client-supplied authentication parameters; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no prior credentials or user interaction are needed. Limiting factors: the target must be running IBM i 7.3, 7.4, 7.5, or 7.6 with the vulnerable authentication-handling service network-reachable from the attacker. The specific service, port, or protocol is not named in the provided data, so whether default configurations expose it cannot be confirmed from the input and should be verified against IBM's advisory. |
| Impact | The signals are mixed but lean toward a genuine high priority tempered by no confirmed exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) describes an unauthenticated, low-complexity, remote full compromise - the worst-case profile - and CWE-287 auth bypasses are directly exploitable once the vulnerable endpoint is identified. Against this, EPSS is only 0.32% (24th percentile), the CVE is NOT in CISA KEV, and no POC is referenced, so there is currently no evidence of active or automated exploitation. The description is terse and does not specify the affected service, protocol, or any preconditions, so the AC:L / PR:N assumptions cannot be independently confirmed from the input - verify the attack surface with IBM before assuming default-configuration exploitability. Net: patch promptly given the criticality and vendor-confirmed fix, but the absence of KEV/POC signals suggests this is not yet under widespread attack. |
| Exploit ScenarioDerived | An attacker with network reachability to an affected IBM i system sends a connection request to the vulnerable authentication service with crafted or empty client-supplied authentication parameters. Because the server validates these improperly, it accepts the request as an authenticated session, granting the attacker unauthorized access to system data and functions. No public exploit code is currently referenced, so this scenario reflects the vector implied by CVSS rather than an observed attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 08, 2026
Authentication bypass in IBM i (the operating system for IBM Power servers, formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to gain unauthorized access by supplying malformed or manipulated authentication parameters that the system fails to validate correctly. Rated CVSS 9.8, the flaw grants full compromise of confidentiality, integrity, and availability without prior credentials. No public exploit identified at time of analysis, and EPSS is low (0.32%, 24th percentile), indicating no observed mass exploitation despite the critical score.
Earlier versions of this analysis (1)
Authentication bypass in IBM i 7.3 through 7.6 allows remote unauthenticated attackers to gain unauthorized access by exploiting improper validation of client-supplied authentication parameters. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network-reachable exploitation without credentials, though elevated attack complexity (AC:H) implies specific conditions must be met. Full confidentiality, integrity, and availability impact are assigned, suggesting successful exploitation grants substantial control over the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply the IBM-provided fix per the vendor advisory at https://www.ibm.com/support/pages/node/7286186 (Patch available per vendor advisory - the input does not state an exact PTF or cumulative package identifier, so obtain the specific PTF number for your release from that node). Because all supported releases (7.3-7.6) are impacted, apply the corresponding PTF to each affected system. Until patched, restrict network reachability of the affected authentication service to trusted management networks and place the systems behind firewall/ACL rules limiting access to known administrative hosts; note this compensating control reduces exposure but does not eliminate risk from internal or trusted-network attackers and may disrupt legitimate remote clients that rely on the affected service. Prioritize internet-exposed or DMZ-facing IBM i systems first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM i is IBM's integrated midrange operating environment running on Power hardware, widely used for transactional and line-of-business workloads in finance, manufacturing, and retail. The root cause is CWE-287 (Improper Authentication): a network-facing service accepts client-supplied authentication parameters and validates them improperly, so an attacker can present values that the server treats as a valid identity. The affected CPE is cpe:2.3:a:ibm:i across all currently supported releases (7.3 through 7.6), suggesting the defect resides in a shared authentication code path rather than a single release-specific feature. IBM's advisory (node 7286186) does not, in the provided data, name the specific service or protocol endpoint involved.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote auth bypass (CWE-287) yields full system access, so PR:N/UI:N with C:H/I:H/A:H; AC:L accepted from vendor absent evidence of preconditions.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.
Executive ViewAI
IBM Power servers running IBM i versions 7.3-7.6 contain a critical authentication bypass allowing unauthenticated remote attackers to gain complete system access. Organizations operating these systems for business-critical applications face direct risks to data security and operational continuity. Although no active exploitation has been observed, the severity and remote accessibility of this vulnerability demand urgent remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB