EUVD-2026-58474
GHSA-8pvc-cf88-ph2f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable XXE requiring low-privileged authentication; impact is confidentiality-only with no integrity, availability, or scope-change effect.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities.
AnalysisAI
XML External Entity (XXE) injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to exfiltrate sensitive information by submitting crafted XML payloads to an XML-processing component on the platform. The CVSS vector (AV:N/AC:L/PR:L) confirms low-complexity network exploitation requiring only a low-privileged account, with high confidentiality impact and no integrity or availability effect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated account on the affected IBM i system with at least low-privileged access (confirmed by CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score is grounded in a network-accessible, low-complexity attack (AV:N/AC:L) requiring only low-privileged authentication (PR:L), yielding high confidentiality impact (C:H) with no integrity or availability consequence (I:N/A:N/S:U). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid low-privileged IBM i user account submits a crafted XML document containing an external entity declaration (e.g., pointing to a sensitive local file such as a system password store or configuration file) to an XML-processing endpoint on the IBM i platform. The parser resolves the external entity without restriction and reflects the file contents back in the response, exposing sensitive system information to the attacker. … |
| Remediation | Apply the vendor-released patch documented in the IBM Security Bulletin at https://www.ibm.com/support/pages/node/7283286, which covers all four affected releases (7.3, 7.4, 7.5, 7.6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today