EUVD-2026-71600
GHSA-7qxf-jvwj-cmgq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local authenticated access required (AV:L/PR:L); only limited file disclosure with no integrity or availability impact (C:L/I:N/A:N), consistent with vendor scoring.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from a privileged file when using SSH.
AnalysisAI
IBM i versions 7.5 and 7.6 expose privileged file contents to locally authenticated users operating over SSH, allowing a low-privilege account to read information that should be restricted by the operating system's privilege model. The vulnerability is rooted in CWE-267 (Privilege Defined With Unsafe Actions), meaning the IBM i SSH subsystem permits file access operations that violate the intended privilege boundary for the relevant file. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid local user account on the target IBM i 7.5 or 7.6 system with SSH access enabled (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.3 Low rating accurately characterizes the constrained attack surface: exploitation requires pre-existing local system access with at least low privileges (AV:L, PR:L), and the confidentiality impact is limited to partial disclosure (C:L) with no integrity or availability component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the IBM-provided fix detailed in the vendor advisory at https://www.ibm.com/support/pages/node/7285938; IBM i patches are typically delivered as Program Temporary Fixes (PTFs) and the specific PTF numbers should be obtained directly from that page. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-267 – Privilege Defined With Unsafe Actions
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today