Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-13T21:17:42.160Z",
  "pubdate": "2026-08-13T21:17:42.160Z",
  "executiveSummary": "A vulnerability exists within IBM i versions 7.6, 7.5, 7.4, and 7.3 that could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.\nThis security flaw represents a severe risk to organizational data confidentiality, integrity, and system availability. An unauthenticated remote attacker can exploit the improper authentication mechanism to bypass standard security controls, interact with vulnerable components, and gain unauthorized access to protected system resources.\nThe potential impact includes the unauthorized disclosure of sensitive data, system compromise, and the execution of arbitrary code with the privileges associated with the vulnerable service.\nSuccessful exploitation requires network connectivity to the targeted IBM i system and leverages weaknesses in how authentication states or credentials are validated by the underlying architecture.\nOrganizations utilizing the affected IBM i versions must prioritize identifying vulnerable systems and applying official vendor-supplied security patches or workarounds to mitigate potential exploitation risks.",
  "technicalDetails": "The vulnerability stems from an improper authentication flaw residing within IBM i 7.6, 7.5, 7.4, and 7.3. Improper authentication occurs when an application or service fails to adequately verify the identity of a user or system component before granting access to sensitive functionalities or data.\nFrom a network exposure perspective, the vulnerable component is accessible remotely, allowing an attacker without prior credentials or with insufficient validation checks to interact directly with the affected interface. The root cause lies in flawed session handling, missing cryptographic checks, or logic errors within the authentication state machine of the targeted service.\nThe attack flow begins when a remote adversary sends a crafted request targeting the vulnerable authentication interface. Because the system fails to properly validate the authenticity of the incoming request or the session parameters, the security boundary is bypassed entirely. This improper verification allows the malicious actor to bypass authentication checks without presenting valid credentials.\nOnce the authentication mechanism is successfully bypassed, the attacker can leverage the compromised context to achieve two primary objectives: sensitive information disclosure and arbitrary code execution. For information disclosure, the attacker issues unauthorized queries or commands to retrieve sensitive system data, configuration files, or user credentials residing in memory or storage. For arbitrary code execution, the attacker injects malicious payloads into the data stream, which are subsequently processed and executed by the underlying operating system or application runtime.\nThe post-exploitation impact is extensive, granting the attacker unauthorized control over the affected IBM i instance, enabling lateral movement within the network, privilege escalation if the executed code runs with elevated permissions, and persistent access to the compromised environment."
}