What is the CVSS score of EUVD-2026-58389?

EUVD-2026-58389 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of IBM i are affected by EUVD-2026-58389?

A CSRF token validation flaw in IBM i systems (versions 7.3-7.6) allows authenticated attackers to bypass security controls and perform unauthorized actions, potentially compromising confidential…. A patch is available.

How to fix or mitigate EUVD-2026-58389?

Within 24 hours: Inventory all IBM i systems running versions 7.3-7.6 and classify by business criticality. Within 7 days: Apply IBM advisory 7283569 patch to test environments and validate application functionality and system stability. Within 30 days: Complete patch deployment to all production systems according to your change management procedures and confirm all systems are running the patched version.

IBM i EUVD-2026-58389

| CVE-2026-17069 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-08-13 ibm

GHSA-2pm2-c9xh-qfxq

CSRF IBM

7.3

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Low-privilege authentication (PR:L) required; no victim interaction needed for token bypass; no availability impact from CSRF exploitation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Aug 17, 2026 - 15:52 NVD

8.1 (HIGH) 7.3 (HIGH)

Analysis Generated

Aug 13, 2026 - 20:42 vuln.today

CVE Published

Aug 13, 2026 - 19:55 nvd

HIGH 8.1

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens.

AnalysisAI

Improper anti-CSRF token validation in IBM i 7.3 through 7.6 enables remote authenticated attackers to bypass CSRF security controls, resulting in high confidentiality and integrity compromise (CVSS 8.1). The flaw is rooted in the server's failure to correctly validate CSRF tokens on state-changing requests, allowing a low-privileged authenticated attacker to forge or replay requests without victim interaction. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7283569.

Technical ContextAI

IBM i (formerly AS/400/iSeries) is IBM's proprietary midrange operating system primarily serving enterprise workloads in finance, retail, and insurance sectors. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) spans versions 7.3, 7.4, 7.5, and 7.6. CWE-352 (Cross-Site Request Forgery) identifies the root cause: the application's web-facing layer fails to properly validate anti-CSRF tokens on incoming requests. Unlike classic browser-based CSRF, the CVSS UI:N metric indicates this bypass does not require luring a victim user - the authenticated attacker (PR:L) can directly submit requests that circumvent CSRF controls, bypassing a security mechanism intended to prevent unauthorized state changes.

RemediationAI

IBM has released a patch addressing this vulnerability; apply the fix detailed in IBM support advisory 7283569 at https://www.ibm.com/support/pages/node/7283569. The exact patched version or PTF (Program Temporary Fix) number should be confirmed directly from that advisory, as it was not independently enumerated in the available source data. As a compensating control pending patch application, restrict access to IBM i web-facing services to the minimum required user population - particularly limiting external or internet-facing exposure of the affected web interfaces. Enforcing strict network segmentation (e.g., allowing access only from trusted internal subnets) reduces the attack surface, though it does not eliminate the vulnerability for internal authenticated users. Note that restricting access may impact legitimate administrative workflows if IBM i web services are used for routine operations.