What is the CVSS score of EUVD-2026-58380?

EUVD-2026-58380 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by EUVD-2026-58380?

Path traversal vulnerability in IBM i versions 7.3-7.6 allows authenticated users to bypass security controls and access, modify, or disrupt critical system objects.. A patch is available.

How to fix or mitigate EUVD-2026-58380?

Within 24 hours: Identify and inventory all IBM i systems running versions 7.3 through 7.6; implement access controls restricting authenticated low-privilege users from accessing sensitive system objects and configuration data. Within 7 days: Obtain and test the vendor-released patch in a non-production environment to validate compatibility with existing applications and system configuration. Within 30 days: Deploy the patched IBM i version to all production systems, prioritizing those hosting business-critical applications and sensitive data; verify successful remediation by confirming patch application across all affected instances.

IBM i EUVD-2026-58380

| CVE-2026-16908 HIGH

Path Traversal (CWE-22)

2026-08-13 ibm

GHSA-g7j6-8mr7-423q

Authentication Bypass Path Traversal IBM

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible exploitation with low-privilege authentication (PR:L); path traversal granting unrestricted object read, write, and availability impact justifies C:H/I:H/A:H; scope unchanged (S:U) as impact stays within the IBM i system.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 16:00 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 15:52 vuln.today

cvss_changed

CVSS changed

Aug 17, 2026 - 15:52 NVD

8.5 (HIGH) 8.8 (HIGH)

Analysis Generated

Aug 13, 2026 - 20:46 vuln.today

CVE Published

Aug 13, 2026 - 19:52 nvd

HIGH 8.5

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path traversal vulnerability.

AnalysisAI

Path traversal in IBM i versions 7.3 through 7.6 enables a low-privileged remote authenticated attacker to bypass object-level access controls and gain unauthorized read, write, or disruptive access to arbitrary system objects. The CVSS 8.8 rating reflects full C/I/A impact across a network-accessible attack surface requiring only low privilege - consistent with IBM's own report as originating vendor and the EUVD advisory. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; EPSS at 0.36% (29th percentile) indicates low current exploitation activity, though a vendor patch is now confirmed available.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is an integrated operating system developed by IBM, widely deployed in banking, manufacturing, and government for mission-critical enterprise workloads. Its architecture is object-based, meaning 'arbitrary objects' encompasses files, programs, data queues, user spaces, journals, and other OS-level constructs - not merely filesystem paths. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), indicating that one or more network-facing IBM i components fails to adequately validate or canonicalize user-supplied path data before resolving it, permitting traversal sequences to escape the intended object namespace and reference out-of-scope resources. The CPE entry cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* confirms the flaw resides in IBM i itself rather than a third-party add-on. IBM i exposes numerous network services (DDM, FTP, ODBC, HTTP, and others) any of which could serve as the delivery channel if path-handling is implicated.

RemediationAI

The primary remediation is to apply the vendor-released patch documented in IBM's support bulletin at https://www.ibm.com/support/pages/node/7283294. An exact PTF (Program Temporary Fix) identifier or release level is not independently present in the provided data, so administrators must consult that advisory directly for the specific fix packages applicable to each installed IBM i release (7.3, 7.4, 7.5, or 7.6). Where immediate patching is constrained by change-freeze windows, a compensating control is to restrict network access to IBM i server services - particularly DDM, FTP, and HTTP-based interfaces that perform path or object resolution - to trusted network segments only, reducing the population of authenticated users who can submit crafted traversal requests. Additionally, enabling IBM i exit point programs for the relevant server types allows administrators to intercept and log or block anomalous path references; this carries a performance and configuration overhead but provides visibility until the patch is applied. Object authority auditing via DSPAUTUSR and CHKOBJ can help identify any unauthorized access that may have already occurred.