EUVD-2026-57351
GHSA-xjff-fp5w-v7v9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable but requires high-privilege authentication and precisely crafted multipart payload; integrity impact limited to security restriction bypass with no confidentiality or availability effect.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser.
AnalysisAI
Security restriction bypass in IBM i 7.3 through 7.6 exploits an interpretation conflict in the multipart parser, enabling a remote attacker with high administrative privileges to circumvent configured access controls with low integrity impact. The flaw (CWE-436) arises when the security enforcement layer and the processing layer disagree on how to interpret multipart message boundaries, allowing carefully crafted requests to evade security checks. No public exploit code and no CISA KEV listing have been identified at time of analysis; IBM has released a patch via its support portal.
Technical ContextAI
IBM i is IBM's proprietary integrated operating system for Power Systems servers, historically known as OS/400 and i5/OS, running on IBM POWER architecture hardware. The vulnerability resides in the system's multipart parser, a component responsible for processing multipart MIME-formatted requests. CWE-436 (Interpretation Conflict) describes a root cause where two components within the same system parse or interpret the same input differently - in this case, the security enforcement layer applies restrictions based on one interpretation of multipart boundary or content structure, while the operational processing layer acts on a differing interpretation, allowing a carefully constructed payload to pass through security gates unintended. The affected CPE is cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covering versions 7.3, 7.4, 7.5, and 7.6.
RemediationAI
Apply the vendor-released patch documented in IBM's support advisory at https://www.ibm.com/support/pages/node/7283292; exact PTF numbers and cumulative package identifiers must be obtained directly from that page, as they are not independently confirmed from the available data. While scheduling the patch, organizations can reduce exposure by restricting network access to IBM i systems so that only authorized management hosts can reach the interfaces that invoke multipart parsing, and by auditing high-privilege account activity for anomalous request patterns targeting security boundary components. Tightening high-privilege account provisioning - revoking PR:H accounts that are no longer operationally necessary - directly limits the attacker population, since exploitation requires such credentials. Note that network access restrictions may impact legitimate remote administration workflows and should be validated against operational requirements before deployment.
Same weakness CWE-436 – Interpretation Conflict
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today