Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication during service-name matching.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-04T17:16:52.643Z",
  "pubdate": "2026-09-04T17:16:52.643Z",
  "executiveSummary": "IBM i versions 7.3, 7.4, 7.5, and 7.6 are susceptible to a security restriction bypass vulnerability originating from improper authentication logic during service-name matching.\nThis vulnerability allows a remote authenticated attacker to circumvent established security controls, potentially gaining unauthorized access to service functions that should be restricted.\nThe flaw resides in the handling of service-name resolution, where inadequate validation or faulty matching logic fails to enforce appropriate authentication boundaries.\nThe risk implication is significant, as it undermines the integrity of the IBM i security model, allowing attackers to perform actions beyond their authorized scope.\nExploitation requires the attacker to possess authenticated access to the system, suggesting that internal threat actors or compromised low-privilege accounts could escalate their capabilities.\nThe impact includes unauthorized access to system services, potential data exposure, or manipulation of restricted operations that the attacker would otherwise be unable to execute.",
  "technicalDetails": "The vulnerability exists due to a flaw in the service-name matching logic within the IBM i operating system architecture. During the service request process, the system must correlate an incoming service request with its corresponding internal service identifier to apply appropriate access control lists and authentication checks.\nThe root cause is identified as an improper authentication process during this service-name matching phase. When a service is requested, the system performs a string comparison or identifier resolution to determine which security policy to apply. If this matching process is flawed—for instance, due to case-insensitivity, improper handling of reserved characters, or lack of strict canonicalization—the service discovery mechanism may resolve the request to an unintended or higher-privileged service function.\nAn authenticated attacker can exploit this by crafting malicious service request parameters. By manipulating the service-name strings provided during the request initiation, an attacker can influence the matching engine to misidentify the target service. If the matching logic defaults to a broader or less secure service entry than the one actually intended, the system may bypass the stringent authentication or authorization checks required for the legitimate, restricted service.\nStep-by-step attack flow: 1. The attacker establishes an authenticated session on the IBM i target. 2. The attacker initiates a connection or call to a system service, providing a specifically crafted service name designed to trigger the flawed matching logic. 3. The system's resolution component processes the input and, due to the improper matching logic, incorrectly maps the request to a sensitive service. 4. The system validates the request against the security policy of the incorrectly resolved, less-restrictive service. 5. The service executes the request, effectively granting the attacker access to restricted functions. 6. The attacker leverages this unauthorized context to execute commands or access data that should have remained inaccessible under their existing security clearance.\nThe vulnerability affects IBM i versions 7.3, 7.4, 7.5, and 7.6. The exposure is limited to authenticated users; however, once the bypass is achieved, the potential for post-exploitation impact is high, as the integrity of the service-level access control model is effectively invalidated. The payload behavior is strictly defined by the targeted service's capabilities, allowing the attacker to perform any action permitted by the service erroneously mapped to by the matching engine."
}