IBM i CVE-2026-2311

The attacker must already possess high-privilege administrator credentials for the IBM i system and must have network access to the Web Administration GUI interface. Additionally, the attacker must actively interact with the GUI (UI:R requirement in CVSS vector) to trigger the authorization check failure-this is not a passive or automatic exploit. The vulnerability is specific to the Web Administration GUI component; non-GUI administrative access methods are not affected by this flaw. Attack complexity is high (AC:H), indicating that successful exploitation requires non-trivial preconditions or environmental factors beyond simple credential possession; the exact nature of these conditions (e.g., specific GUI state, timing, or feature combinations) is not detailed in available disclosures but is factored into the CVSS assessment.

The CVSS score of 6.4 (Medium) is driven by high impact ratings (C:H, I:H, A:H) but significantly constrained by requiring high privileges (PR:H), high attack complexity (AC:H), and user interaction (UI:R), all of which substantially reduce real-world exploitability. The network attack vector (AV:N) indicates remote accessibility, but the combination of PR:H and UI:R requirements means only already-trusted high-privilege users can initiate the attack, and only through deliberate interaction with the GUI. The absence from CISA's KEV catalog and lack of public exploit code suggest this has not yet seen demonstrated exploitation in the wild. Risk prioritization depends on organizational exposure: environments with many high-privilege IBM i administrators pose higher risk, particularly if those admins are not fully trusted or are working under duress. However, the attack does not grant new privileges to an unauthenticated or low-privilege user-it requires pre-existing administrator access to escalate within the same privilege domain. Organizations with strong administrative access controls and audit logging are better positioned to detect misuse.

An administrator with legitimate high-privilege access to an IBM i system logs into the Web Administration GUI and, through a specially crafted interaction or sequence of actions within the GUI, exploits the authorization check failure. The GUI fails to properly validate whether the action the administrator is attempting is permitted, allowing them to execute code or perform operations that should be restricted even for high-privilege users. An attacker who has compromised a high-privilege administrative account, or a malicious insider with such access, could execute this attack to escalate their effective privileges or bypass further security controls.