Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T20:17:15.723Z",
  "pubdate": "2026-08-13T20:17:15.723Z",
  "executiveSummary": "An improper authentication vulnerability exists in IBM i 7.6, 7.5, 7.4, and 7.3 during NTLM session negotiation. This security flaw allows a remote attacker to interact with and access server resources under the authorization context of an authenticated user.\nThe vulnerability introduces significant risk to enterprise environments by breaking trust boundaries within network authentication protocols. An unauthorized remote actor leveraging this flaw can bypass standard session validation controls, leading to unauthorized resource access.\nThe attack vector involves network-based exploitation during the cryptographic handshake phase of NTLM session establishment. Successful exploitation requires network connectivity to the vulnerable IBM i server and relies on vulnerabilities within the session negotiation logic, without necessitating prior authentication by the threat actor.\nOrganizations utilizing affected IBM i versions face potential confidentiality and integrity risks as unauthorized entities gain the capability to query and interact with sensitive system resources using legitimate user privileges.",
  "technicalDetails": "The vulnerability resides within the authentication subsystem of IBM i 7.6, 7.5, 7.4, and 7.3, specifically during the handling and processing of NTLM session negotiation sequences.\nThe root cause stems from improper validation and verification of cryptographic exchanges and state maintenance during the NTLM challenge-response mechanism. Insufficient checks allow an attacker to improperly manipulate or bypass the authentication state machine, tricking the server into accepting an unauthorized session as valid.\nFrom a network exposure perspective, the vulnerable component is accessible remotely over protocols that utilize NTLM authentication services provided by the operating system. Attackers do not require prior privileges or pre-existing credentials on the target system to initiate the attack flow.\nThe step-by-step exploitation method involves the attacker intercepting or directly initiating a network connection with the IBM i server to negotiate an NTLM authentication session. During the negotiation phase, the attacker exploits the flawed session handling logic by supplying crafted or manipulated NTLM protocol messages.\nBecause the server fails to properly enforce strict cryptographic verification or state continuity during the handshake, it incorrectly associates the attacker's connection with the security context of a legitimately authenticated user.\nOnce the flawed negotiation succeeds, the server grants the malicious session the privileges and access rights of the targeted authenticated user. This post-exploitation state enables the remote attacker to execute authorized operations, read restricted server resources, and perform transactions within the scope of the hijacked security context.\nThe technical impact includes unauthorized authorization reuse, complete session spoofing capabilities during negotiation, and degradation of trust models dependent on NTLM on the specified IBM i releases."
}