What is the CVSS score of EUVD-2026-58378?

EUVD-2026-58378 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of IBM i are affected by EUVD-2026-58378?

IBM i operating systems versions 7.3 through 7.6 are vulnerable to unauthorized file access through a race condition that allows authenticated local users to bypass access controls.. A patch is available.

How to fix or mitigate EUVD-2026-58378?

Within 24 hours, inventory all IBM i systems running versions 7.3 through 7.6 and classify by data sensitivity and change management urgency. Within 7 days, apply the vendor-released patch to production systems and critical data repositories per your change control schedule. Within 30 days, complete patch deployment to all remaining affected systems and confirm remediation through vulnerability scanning.

IBM i EUVD-2026-58378

| CVE-2026-16896 MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-08-13 ibm

GHSA-5j9j-5mc9-fhx9

Authentication Bypass IBM

4.7

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

4.7 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.3 MEDIUM

TOCTOU race conditions require precise timing to win, justifying AC:H over the vendor-assigned AC:L; all other metrics align with local low-privilege exploitation with high C and I impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Aug 17, 2026 - 17:22 NVD

HIGH MEDIUM

CVSS changed

Aug 17, 2026 - 17:22 NVD

7.1 (HIGH) 4.7 (MEDIUM)

Analysis Generated

Aug 13, 2026 - 20:46 vuln.today

CVE Published

Aug 13, 2026 - 19:51 nvd

HIGH 7.1

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to obtain unauthorized access to files due to a time-of-check time-of-use (TOCTOU) race condition.

AnalysisAI

Unauthorized file access in IBM i 7.3 through 7.6 is possible via a TOCTOU race condition exploitable by local authenticated users. The flaw allows an attacker with local access and low privileges to win a timing window between a file permission check and the subsequent file operation, bypassing intended access controls. No public exploit code has been identified at time of analysis, but IBM has released a patch and the CVSS score of 7.1 reflects high confidentiality and integrity impact.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is an IBM midrange operating system known for its integrated database and object-based security model. The vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use Race Condition), a concurrency flaw in which a resource's state changes between the moment it is validated and the moment it is used. In this case, the OS fails to atomically check and use file access permissions, creating a exploitable window. The CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* confirms all sub-versions of IBM i are in scope across versions 7.3, 7.4, 7.5, and 7.6.

RemediationAI

Apply the vendor-released patch per IBM's advisory at https://www.ibm.com/support/pages/node/7283293. IBM has confirmed a fix is available; administrators should consult the advisory for the exact PTF (Program Temporary Fix) identifiers applicable to their specific IBM i version (7.3, 7.4, 7.5, or 7.6). As a compensating control prior to patching, restrict local shell or interactive access to only necessary and trusted users, and audit which accounts hold local login rights on IBM i partitions. Minimizing the number of locally authenticated sessions reduces the window available for exploitation. Note that restricting access may affect legitimate operators who require local sessions for administrative tasks.