What is the CVSS score of EUVD-2026-57347?

EUVD-2026-57347 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of IBM i are affected by EUVD-2026-57347?

IBM i Navigator for i versions 7.3-7.6 contain a privilege escalation vulnerability allowing any authenticated user to execute arbitrary commands as root, directly compromising system integrity and…. A patch is available.

How to fix or mitigate EUVD-2026-57347?

Within 24 hours: Inventory all systems running IBM i Navigator for i versions 7.3 through 7.6 and restrict network access to trusted administrative users only. Within 7 days: Obtain the vendor-released patch and deploy to non-production environments; conduct functional testing of critical business workflows on the patched version. Within 30 days: Stage and execute patch deployment to all affected production systems, prioritizing systems processing payment data or personally identifiable information, and verify patch application via vendor-provided system audit commands.

IBM i EUVD-2026-57347

| CVE-2026-18683 HIGH

OS Command Injection (CWE-78)

2026-08-12 ibm

GHSA-wj8v-wr57-4g99

Privilege Escalation Command Injection IBM

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible Navigator for i requires only a low-privileged account (PR:L); root-level command execution yields full C/I/A impact with no scope change (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 17:39 vuln.today

CVE Published

Aug 12, 2026 - 16:49 nvd

HIGH 8.8

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.

AnalysisAI

Privilege escalation via OS command injection in IBM i Navigator for i (versions 7.3 through 7.6) allows any authenticated, low-privileged network user to execute arbitrary OS commands as the root user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) confirms this is a low-complexity, network-accessible exploit requiring only a valid user account - no additional privileges or user interaction needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full CIA impact make this a genuine remediation priority for IBM i environments.

Technical ContextAI

IBM i (formerly AS/400/iSeries) is IBM's integrated operating system for mid-range Power Systems servers, widely used in financial services, manufacturing, and government for mission-critical workloads. Navigator for i is the bundled web-based graphical administration interface that exposes OS management functions over the network. CWE-78 (Improper Neutralization of Special Elements used in an OS Command - OS Command Injection) identifies the root cause: user-supplied input passed to a system-level command executor is not properly sanitized, allowing an attacker to inject additional shell metacharacters or command sequences. The injected commands inherit the elevated privileges of the underlying Navigator service process, ultimately executing as root. The affected CPE is cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covering all IBM i editions across the stated version range.

RemediationAI

Apply the vendor-released PTFs (Program Temporary Fixes) documented in the IBM advisory at https://www.ibm.com/support/pages/node/7283292 - this page provides the specific PTF numbers for each affected release (7.3, 7.4, 7.5, 7.6) and should be consulted directly as exact fix identifiers were not included in available intelligence data. As a compensating control pending patching, restrict network access to the Navigator for i web interface (typically TCP 2001/2010) to only designated administrator workstations via IBM i TCP/IP filtering or perimeter firewall rules - this eliminates the network attack vector (AV:N) and prevents exploitation by non-administrator users on the broader network. Note that disabling Navigator for i entirely will remove the graphical management capability; operators would need to fall back to 5250 terminal or IBM i Access Client Solutions for system management. Review and minimize the set of IBM i user profiles that have Navigator for i access rights as an additional layer of defense.