What is the CVSS score of EUVD-2026-58382?

EUVD-2026-58382 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM i are affected by EUVD-2026-58382?

IBM i systems versions 7.3 through 7.6 contain a privilege escalation vulnerability (CVSS 8.5) that allows authenticated low-privilege users to gain unauthorized access to privileged system objects…. A patch is available.

How to fix or mitigate EUVD-2026-58382?

Within 24 hours, inventory all IBM i systems running versions 7.3 through 7.6 and assess the prevalence of low-privilege user accounts with network access. Within 7 days, apply the vendor-released patch from the IBM advisory to all affected IBM i systems, prioritizing production environments and systems with sensitive data access. Within 30 days, verify successful patch deployment across all systems, review system access logs and privilege escalation attempts from the past 90 days, and conduct a follow-up scan to confirm the vulnerability has been remediated.

IBM i EUVD-2026-58382

| CVE-2026-16967 HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-08-13 ibm

GHSA-qwqr-8x7g-3rr8

Authentication Bypass IBM

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Race condition demands precise timing (AC:H); authenticated low-privilege required (PR:L); scope change justified by symlink redirect reaching objects outside the attacker's normal boundary.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Aug 17, 2026 - 15:37 NVD

8.5 (HIGH) 7.5 (HIGH)

Analysis Generated

Aug 13, 2026 - 20:45 vuln.today

CVE Published

Aug 13, 2026 - 19:53 nvd

HIGH 8.5

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system objects due to a time-of-check to time-of-use (TOCTOU) race condition involving symbolic links.

AnalysisAI

Unauthorized access to privileged system objects is possible in IBM i 7.3 through 7.6 via a time-of-check to time-of-use (TOCTOU) race condition exploiting symbolic links, reachable by remote authenticated low-privilege users. The CVSS scope change (S:C) combined with full C/I/A impact signals that successful exploitation can reach objects and resources beyond the attacker's normal privilege boundary, effectively enabling privilege escalation across the OS. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is available via the IBM advisory.

Technical ContextAI

IBM i (formerly AS/400, iSeries) is IBM's proprietary, integrated operating system designed for IBM Power Systems hardware, widely deployed in financial, insurance, and manufacturing sectors. CWE-367 (TOCTOU Race Condition) describes a class of vulnerability where a security check on a resource (e.g., verifying symlink target permissions) is separated from actual resource use; between those two moments, a concurrent thread or process can replace the symlink so it points to a higher-privileged object. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) covers all sub-versions of IBM i 7.3, 7.4, 7.5, and 7.6. On IBM i, symbolic-link handling intersects with its unique integrated file system (IFS), making TOCTOU conditions particularly consequential because IFS objects span databases, libraries, and OS-level resources under a unified namespace.

RemediationAI

IBM has released a patch, confirmed available via the vendor advisory at https://www.ibm.com/support/pages/node/7283294; administrators should consult that page for the specific PTF numbers applicable to their IBM i release (7.3, 7.4, 7.5, or 7.6) and apply them through normal PTF delivery channels. An exact fixed build or version number was not independently derivable from the available input data - verify the precise PTF identifier directly from the IBM advisory before declaring remediation complete. As a compensating control prior to patching, restrict interactive and network logon rights to the minimum necessary set of authenticated users, and audit IFS symbolic link permissions to identify any objects writable by low-privilege accounts. Note that restricting symlink creation rights may impact legitimate applications that rely on IFS links; test in a non-production LPAR before enforcing broadly.