What is the CVSS score of EUVD-2026-57352?

EUVD-2026-57352 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by EUVD-2026-57352?

A privilege escalation vulnerability in IBM i 7.3-7.6 allows internal users with standard system accounts to escalate their privileges, creating insider-threat and lateral-movement risks within…. A patch is available.

How to fix or mitigate EUVD-2026-57352?

Within 24 hours, identify and document all IBM i systems running versions 7.3 through 7.6, their business function, and user base to assess exposure scope. Within 7 days, apply the vendor-released patch to all affected instances according to IBM's security advisory in a planned maintenance window. Within 30 days, perform a complete security audit of system logs and user activity to identify any unauthorized privilege escalations or suspicious access patterns that may have occurred during the vulnerability exposure period.

IBM i EUVD-2026-57352

| CVE-2026-17095 HIGH

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-08-12 ibm

GHSA-93m7-g75g-jvv8

Authentication Bypass IBM

8.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

8.3 HIGH

Network-reachable, low complexity bypass requiring only a valid user account; high C/I impact from unrestricted data access, low A since availability is not materially affected.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 17:40 vuln.today

CVE Published

Aug 12, 2026 - 16:56 nvd

HIGH 8.3

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection.

AnalysisAI

Security restriction bypass in IBM i 7.3 through 7.6 enables remote authenticated attackers to elevate privileges via unsafe Java reflection (CWE-915), allowing dynamic modification of object attributes in ways the platform's access control layer does not anticipate. The CVSS 8.3 score reflects network reachability, low attack complexity, and high confidentiality and integrity impact - meaning any valid low-privilege account can exploit this without user interaction. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the low barrier to exploitation (PR:L, AC:L) makes this a credible lateral-movement or privilege-escalation path in IBM i shops.

Technical ContextAI

IBM i (formerly OS/400 and i5/OS) is IBM's integrated operating system for Power Systems midrange hardware, widely deployed in banking, insurance, manufacturing, and retail for core business workloads. CWE-915 - 'Improperly Controlled Modification of Dynamically-Determined Object Attributes' - describes a class of flaws where a reflection or introspection API allows an attacker to manipulate object state or class members that the developer did not intend to be externally controlled. In IBM i's context, this likely involves Java or RPG/ILE service program reflection mechanisms that allow an authenticated session to reference or mutate internal security attributes, effectively sidestepping the object-authority and profile-based permission model that IBM i relies upon. The CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers the full IBM i application stack across versions 7.3, 7.4, 7.5, and 7.6, with no sub-version pinpointing currently available from NVD.

RemediationAI

IBM has released a patch for this vulnerability; apply the relevant PTF (Program Temporary Fix) or PTF group identified in the IBM support document at https://www.ibm.com/support/pages/node/7283292 for your specific IBM i release (7.3, 7.4, 7.5, or 7.6). The exact PTF numbers are detailed in that advisory and should be applied during the next available maintenance window. If immediate patching is not possible, restrict network access to IBM i service ports to trusted administrative networks and enforce the principle of least privilege by auditing and reducing the number of accounts with any level of interactive or API session access - this raises the bar for exploitation since PR:L requires a valid authenticated session. Note that reducing user accounts has the trade-off of potentially disrupting batch job identities or service accounts; audit *USRPRF objects before removal. There is no indication of a workaround that fully mitigates the unsafe reflection root cause without the vendor patch.