Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T20:17:14.527Z",
  "pubdate": "2026-08-13T20:17:14.527Z",
  "executiveSummary": "An untrusted search path vulnerability exists within IBM i versions 7.6, 7.5, 7.4, and 7.3, which could enable a remote authenticated attacker to execute arbitrary code.\nThe flaw stems from improper handling of search paths, allowing malicious actors to manipulate the execution environment and force the loading of unauthorized libraries or binaries.\nSuccessful exploitation requires authentication and allows an attacker to compromise the integrity and availability of the affected operating system by executing arbitrary code with the privileges of the vulnerable process.\nThe risk implications include unauthorized system access, potential privilege escalation, and execution of malicious payloads within the administrative boundaries of the IBM i environment.",
  "technicalDetails": "The vulnerability is rooted in an untrusted search path flaw, commonly classified under insecure library loading or dynamic linking weaknesses.\nWhen the affected IBM i components attempt to load dynamic libraries, binaries, or command executions without specifying fully qualified paths, the system relies on a predefined search path order.\nIf an attacker can place a maliciously crafted payload with the same name as a legitimate dependency into a directory that is evaluated earlier in the search path sequence, the application will inadvertently load and execute the attacker-controlled code.\nExploitation requires the attacker to possess remote authenticated access to the target system and the capability to write files to a directory parsed by the vulnerable search path.\nUpon successful triggering of the vulnerable component, the malicious payload executes within the context of the running service or application.\nDepending on the execution context and privileges of the affected process, post-exploitation impact can range from local code execution to deeper system-level compromise, enabling the attacker to manipulate sensitive operating system functions, access confidential data, or disrupt normal system operations across IBM i 7.6, 7.5, 7.4, and 7.3."
}