Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-12T18:17:24.397Z",
  "pubdate": "2026-08-12T18:17:24.397Z",
  "executiveSummary": "An uncontrolled search path element vulnerability exists in IBM i versions 7.6, 7.5, 7.4, and 7.3, which could allow a remote authenticated attacker to execute arbitrary code.\nThe vulnerability arises from insecure search path resolution logic within the affected operating system components, enabling malicious actors to manipulate environment paths and force the loading and execution of untrusted libraries or binaries.\nSuccessful exploitation requires remote authentication and grants the attacker the ability to execute arbitrary code within the context of the vulnerable process.\nThe primary risk implication is a potential compromise of system integrity and confidentiality, as unauthorized code execution can lead to privilege escalation, unauthorized access to sensitive data, or manipulation of core system functions.\nOrganizations operating the affected IBM i versions must implement strict access controls and monitor file system permissions to prevent the placement of malicious payloads in searched directories.",
  "technicalDetails": "The root cause of the vulnerability stems from an uncontrolled search path element (commonly categorized under CWE-427) within IBM i 7.6, 7.5, 7.4, and 7.3.\nThe affected components fail to adequately restrict or validate the directories searched when resolving references to external resources, libraries, or binaries.\nExploitation requires a remote authenticated attacker to have sufficient access to place a maliciously crafted payload, such as a dynamically linked library or executable, into a directory that is prioritized within the application or system search path.\nThe attack flow proceeds as follows: first, the attacker authenticates to the target system via an authorized interface; second, the attacker leverages file system write privileges or pre-existing misconfigurations to deposit a malicious binary or library into an insecurely referenced search path location; third, the attacker triggers an application, service, or administrative function that initiates a lookup for the targeted resource without specifying an absolute path.\nDue to the flawed search logic, the operating system or application traverses the environment paths, locates the attacker-supplied payload prior to legitimate system binaries, and loads it into memory.\nUpon successful loading, the payload executes with the privileges of the calling process or user, enabling the attacker to perform unauthorized actions, potentially escalate privileges, or establish persistence within the IBM i environment.\nNetwork exposure is dictated by the accessibility of the authenticated interfaces utilized to deliver the payload and trigger the vulnerable execution flow."
}