EUVD-2026-71607
GHSA-7wjh-qq66-9589
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Auth bypass requires no privileges and is network-reachable, but AC:H reflects specific conditions implied by 'improper validation' wording and the vendor's own CVSS assignment.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.
AnalysisAI
Authentication bypass in IBM i 7.3 through 7.6 allows remote unauthenticated attackers to gain unauthorized access by exploiting improper validation of client-supplied authentication parameters. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network-reachable exploitation without credentials, though elevated attack complexity (AC:H) implies specific conditions must be met. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network-reachable access to an IBM i system running versions 7.3, 7.4, 7.5, or 7.6 and the ability to send client-supplied authentication parameters to a vulnerable service or subsystem. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) represents a high-severity remote authentication bypass with full CIA impact, moderated by high attack complexity - meaning the exploit is not trivially repeatable and likely requires specific network conditions, timing, or protocol state. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch referenced in IBM Security Advisory at https://www.ibm.com/support/pages/node/7286186. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all IBM i systems running versions 7.3-7.6 and determine which are accessible from untrusted networks; prioritize internet-facing systems for immediate action. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today