Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-12T18:17:26.437Z",
  "pubdate": "2026-08-12T18:17:26.437Z",
  "executiveSummary": "A security restriction bypass vulnerability exists in IBM i versions 7.6, 7.5, 7.4, and 7.3.\nThe vulnerability arises due to improper validation of a session token by the affected operating system components.\nA remote authenticated attacker can exploit this flaw to bypass established security restrictions and perform unauthorized actions within the system context.\nThe impact of successful exploitation includes unauthorized access to restricted functionalities and potential compromise of system integrity.\nExploitation requires the attacker to possess valid authentication credentials to interact with the vulnerable session handling mechanisms.\nThe risk implication is significant as it allows authenticated users to escalate their operational scope beyond intended security boundaries.",
  "technicalDetails": "The vulnerability is rooted in the session management subsystem of IBM i 7.6, 7.5, 7.4, and 7.3, specifically within the logic responsible for session token validation.\nDuring the session verification phase, the affected component fails to rigorously validate the authenticity, integrity, or lifecycle state of the provided session token.\nAn attacker with remote network access and valid baseline authentication can manipulate or replay session tokens or supply crafted identifiers that pass the flawed validation check.\nThe attack flow begins when the authenticated attacker initiates a session or interacts with vulnerable endpoints requiring token-based authorization.\nBy bypassing the strict verification checks enforced by the session validation routines, the attacker induces the system to treat an invalid or unauthorized session token as legitimate.\nThis improper validation circumvents security restrictions designed to limit user capabilities based on assigned privileges or session states.\nPost-exploitation impact allows the adversary to execute unauthorized commands, access restricted resources, or perform operations outside their authorized privilege level within the IBM i environment.\nNo specific privileges beyond initial remote authentication are required to trigger the flawed validation logic, making the attack vector accessible to any standard authenticated user."
}