EUVD-2026-57526
GHSA-596w-392m-mr7g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Navigator is web-accessible (AV:N, AC:L); exploitation requires a valid low-privilege account (PR:L); impact is limited to log-file integrity only (I:L, C:N, A:N).
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navigator log files due to improper output neutralization for logs.
AnalysisAI
Log injection in IBM i Navigator (versions 7.3 through 7.6) permits remote authenticated attackers to write arbitrary content into Navigator log files by exploiting improper output neutralization for logs (CWE-117). An attacker with low-privilege credentials can forge, corrupt, or spoof log entries, undermining audit trails and potentially masking malicious activity. IBM has released a patch via advisory node 7283292, and no public exploit code has been identified at time of analysis.
Technical ContextAI
IBM i is IBM's proprietary integrated operating system for Power Systems hardware (formerly AS/400 and iSeries), widely used in financial services and manufacturing for its reliability and transaction processing capabilities. Navigator for i is the web-based system administration interface through which this vulnerability is reachable. The root cause is CWE-117 (Improper Output Neutralization for Logs): user-controlled input containing special characters such as newline sequences (CRLF) is written directly into log files without sanitization, enabling log forging. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all sub-versions of IBM i across the four affected release lines. An attacker exploiting this class of flaw can insert fabricated log entries, erase evidence of other actions by injecting misleading timestamps or event records, or disrupt log-parsing pipelines and SIEM integrations that consume Navigator output.
RemediationAI
Apply the IBM-released patch for Navigator for i as documented in IBM advisory node 7283292 at https://www.ibm.com/support/pages/node/7283292; confirm the applicable PTF number for each affected IBM i release level (7.3, 7.4, 7.5, 7.6) directly from that advisory, as exact fix-version identifiers were not available in the source data. As a compensating control prior to patching, restrict network access to the Navigator for i interface to trusted management subnets using host-based or network-layer firewall rules, noting that this reduces attack surface but does not eliminate the flaw for legitimate users on allowed networks. Additionally, limit Navigator login privileges to only those accounts that operationally require it, reducing the pool of potential authenticating attackers. Forward Navigator log output to an immutable, append-only log aggregation system (such as a remote syslog target with restricted write access) so that injected entries can be detected against a tamper-evident baseline.
Same weakness CWE-117 – Improper Output Neutralization for Logs
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today