What is the CVSS score of EUVD-2026-57519?

EUVD-2026-57519 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of IBM i are affected by EUVD-2026-57519?

A high-severity access control bypass in IBM i versions 7.3 through 7.6 allows remote authenticated users to escalate privileges beyond their authorized scope through crafted profile names.. A patch is available.

How to fix or mitigate EUVD-2026-57519?

Within 24 hours, inventory all systems running IBM i versions 7.3 through 7.6 and isolate or restrict network access if patching cannot be completed immediately. Within 7 days, apply the vendor-released patch to all affected IBM i systems, beginning with production environments. Within 30 days, verify patch deployment completeness across all systems and deploy enhanced monitoring to detect privilege escalation attempts on user profile access.

IBM i EUVD-2026-57519

| CVE-2026-17445 MEDIUM

Execution with Unnecessary Privileges (CWE-250)

2026-08-12 ibm

GHSA-q3x3-rxwg-x76r

Privilege Escalation IBM

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.1 HIGH

Description confirms authentication is required (PR:L), directly contradicting the NVD PR:N assignment; all other metrics align with description and no availability impact is indicated.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Aug 17, 2026 - 17:52 NVD

HIGH MEDIUM

CVSS changed

Aug 17, 2026 - 17:52 NVD

8.2 (HIGH) 6.5 (MEDIUM)

Analysis Generated

Aug 12, 2026 - 20:26 vuln.today

CVE Published

Aug 12, 2026 - 19:34 nvd

HIGH 8.2

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile name.

AnalysisAI

Security restriction bypass in IBM i 7.3 through 7.6 allows remote authenticated attackers to circumvent access controls by supplying a crafted user profile name that passes improper validation logic. The vulnerability is tagged as a privilege escalation path, meaning successful exploitation likely enables access to resources or operations beyond the attacker's authorized scope. No public exploit code or CISA KEV listing is present at time of analysis, but a vendor patch is available and should be prioritized given the high confidentiality impact indicated by CVSS.

Technical ContextAI

IBM i (formerly OS/400 and i5/OS) is an integrated operating system running on IBM Power Systems hardware, widely deployed in regulated industries such as banking, insurance, and manufacturing. Affected versions span 7.3, 7.4, 7.5, and 7.6 per the CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*. CWE-250 (Execution with Unnecessary Privileges) identifies the root cause class: the system is performing operations - or granting access - with a privilege level exceeding what is necessary, triggered by insufficient validation of an attacker-supplied user profile name. In IBM i's security model, user profiles are the primary identity and authorization construct; improper validation of a supplied profile name could allow an attacker to assume the identity or privileges of a different, more privileged profile without legitimately owning it.

RemediationAI

Apply the vendor-released patch via the IBM advisory at https://www.ibm.com/support/pages/node/7283274; IBM i fixes are distributed as PTFs and IBM i Technology Refreshes, so administrators should identify the appropriate PTF for their specific release (7.3, 7.4, 7.5, or 7.6) and apply it through IBM's standard service tools. No exact fix-level PTF number was independently extractable from the provided data - consult the advisory directly for the confirmed fix version. As a compensating control prior to patching, administrators should audit user profile name validation logic in custom applications and restrict network-accessible interfaces that accept user profile names as input to the minimum necessary set of authenticated users. Restricting access to profile management interfaces to trusted administrative subnets reduces exposure but does not eliminate the underlying flaw. Enabling IBM i audit journal (QAUDJRN) for profile change events will improve detection of exploitation attempts.