What is the CVSS score of EUVD-2026-57521?

EUVD-2026-57521 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM i are affected by EUVD-2026-57521?

IBM i system environments running versions 7.3 through 7.6 face privilege escalation risk from authenticated users that could lead to unauthorized system access and data manipulation across critical…. A patch is available.

How to fix or mitigate EUVD-2026-57521?

Within 24 hours, identify all IBM i systems running versions 7.3 through 7.6 in your production and non-production environments and baseline current authenticated user privileges. Within 7 days, deploy the vendor-released patch to test and staging IBM i systems to validate stability and performance impact. Within 30 days, complete patch deployment to all production systems and audit system access logs for anomalous privilege escalation activity.

IBM i EUVD-2026-57521

| CVE-2026-17082 HIGH

Improper Privilege Management (CWE-269)

2026-08-12 ibm

GHSA-48w7-xgfc-4wm7

Privilege Escalation IBM

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network vector confirmed; low privilege (any valid account) required; no interaction needed; full CIA impact matches privilege escalation to elevated profile on a data-sensitive system.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:29 vuln.today

CVE Published

Aug 12, 2026 - 19:36 nvd

HIGH 8.8

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name.

AnalysisAI

Privilege escalation in IBM i 7.3 through 7.6 allows remote authenticated attackers to gain elevated privileges by submitting a crafted, client-supplied profile name that bypasses server-side validation. The root cause is improper privilege management (CWE-269) in profile name handling, enabling an attacker with only low-level authenticated access to escalate to higher system privileges. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and high impact across confidentiality, integrity, and availability make this a serious priority for IBM i environments.

Technical ContextAI

IBM i (formerly AS/400, iSeries) is IBM's integrated operating environment for Power Systems hardware, widely used in enterprise and government settings for mission-critical workloads. The affected versions span IBM i 7.3, 7.4, 7.5, and 7.6 as identified by CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*. CWE-269 (Improper Privilege Management) indicates that the system fails to correctly validate or sanitize a profile name value supplied by the client during some authenticated operation, allowing the server to treat a crafted name as belonging to a higher-privilege profile. This class of flaw typically arises when privilege decisions are made based on user-controlled input rather than authoritative server-side identity resolution.

RemediationAI

Apply the vendor-released patch per the IBM security advisory at https://www.ibm.com/support/pages/node/7283276, which provides PTF-level fixes for each affected release (7.3, 7.4, 7.5, and 7.6). Exact PTF numbers should be retrieved directly from the IBM support page as they vary per release. Patch availability is confirmed by IBM. As a compensating control where immediate patching is not possible, restrict network-level access to IBM i system interfaces involved in profile management to trusted internal segments, and audit existing low-privilege accounts for signs of unexpected privilege escalation. Reducing the number of accounts with any authenticated access to the system minimizes the population of potential exploiters. Note that network segmentation does not eliminate the vulnerability for internally-positioned attackers.