What is the CVSS score of EUVD-2026-57349?

EUVD-2026-57349 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-57349?

Yes, a patch is available for EUVD-2026-57349. Update the affected software to the latest version immediately.

IBM i EUVD-2026-57349

| CVE-2026-18144 MEDIUM

Improper Authorization (CWE-285)

2026-08-12 ibm

GHSA-7g8j-fpwg-4c55

Authentication Bypass IBM

4.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Requires low-privilege authenticated network access; impact is strictly limited integrity bypass with no confidentiality or availability effects and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 17:41 vuln.today

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.

AnalysisAI

Improper authorization in IBM i versions 7.3 through 7.6 allows remote authenticated attackers to bypass security restrictions and perform unauthorized write operations on protected objects or data. The flaw, rooted in CWE-285, requires only low-privilege credentials and no user interaction, making it accessible to any authenticated user on the platform. IBM has released patches via their support advisory, and no active exploitation or public proof-of-concept has been identified at time of analysis.

Technical ContextAI

IBM i (formerly OS/400 and i5/OS) is IBM's proprietary operating system for IBM Power Systems, widely deployed in enterprise environments for mission-critical business workloads such as ERP, financial processing, and manufacturing automation. The vulnerability is classified as CWE-285 (Improper Authorization), which occurs when an application fails to correctly verify that an authenticated user holds the appropriate permissions for a requested operation - distinct from authentication failures (CWE-287). The CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* confirms the affected component is the IBM i operating system itself across all sub-releases of versions 7.3, 7.4, 7.5, and 7.6. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates the flaw is reachable over the network, requires no special conditions, and is constrained to limited integrity impact without privilege escalation beyond the vulnerable system.

RemediationAI

IBM has released patches for all affected versions (7.3, 7.4, 7.5, 7.6) documented in the support advisory at https://www.ibm.com/support/pages/node/7283292; administrators should retrieve and apply the relevant PTF numbers for their release from that page. Exact PTF identifiers are not reproduced in this analysis and must be confirmed directly from the IBM advisory. As a compensating control prior to patching, restrict network access to IBM i service entry points (such as DDM, DRDA, and host server ports) using network access controls or IBM i communications firewall features to limit which hosts can establish authenticated sessions. Additionally, audit and tighten user authority profiles using IBM i's object-level authority model to ensure no user holds more than the minimum required authority, thereby reducing the scope of any authorization bypass. Note that network-level restrictions may affect legitimate remote workflows and should be tested before broad deployment.