Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-04T17:16:53.710Z",
  "pubdate": "2026-09-04T17:16:53.710Z",
  "executiveSummary": "IBM i versions 7.6, 7.5, 7.4, and 7.3 are susceptible to a security restriction bypass vulnerability originating from the use of predictable server seeds.\nThis vulnerability involves insufficient entropy or deterministic generation in security-critical cryptographic or session-related seeding mechanisms.\nThe flaw allows a remote, authenticated attacker to predict generated security artifacts, potentially leading to unauthorized access, session hijacking, or the subversion of cryptographic integrity within the environment.\nThe impact is significant as it undermines the fundamental trust mechanisms required for secure communication and resource access control within the IBM i operating system.\nExploitation requires the attacker to be authenticated to the system, suggesting that the risk is highest in environments where internal access or low-privileged accounts can be leveraged to escalate privileges or bypass intended security controls.\nOrganizations must prioritize the assessment of their specific IBM i configurations and monitor for official vendor patches to remediate the underlying cryptographic weakness.",
  "technicalDetails": "The vulnerability resides in the cryptographic or random number generation sub-systems of IBM i 7.3, 7.4, 7.5, and 7.6. The root cause is the reliance on predictable server seeds during the initialization of security primitives. In secure systems, entropy sources must be sufficiently random to ensure that outputs—such as session tokens, nonces, or cryptographic keys—cannot be anticipated by unauthorized parties.\nWhen server seeds are predictable, the output of the pseudo-random number generator (PRNG) or the state machine governing security tokens becomes deterministic. An attacker who can observe a sequence of generated values or identify the seed initialization pattern can forecast future security tokens or state values.\nThe attack flow requires the adversary to first achieve an authenticated state on the target IBM i system. Once authenticated, the attacker monitors the generation of security-sensitive outputs. By analyzing these outputs against the known or observable seeding behavior, the attacker reconstructs the state of the generator. With the internal state compromised, the attacker can then craft malicious payloads or impersonate other users/services by pre-calculating the expected session identifiers or authentication tokens that the system will accept.\nThe vulnerable component involves the internal kernel or middleware services responsible for managing authentication sessions and cryptographic handshakes. Because the vulnerability allows for the bypassing of security restrictions, the post-exploitation impact includes unauthorized escalation of privileges, bypass of access control lists (ACLs), and the potential for unauthorized data exfiltration or system modification. The exploitation is facilitated by the network exposure of services that rely on these predictable seeds for session management. As this occurs within an authenticated context, the attacker effectively subverts the security perimeter from within, making it difficult to detect through traditional perimeter-based security measures. The lack of true randomness compromises any security mechanism relying on these seeds, including potentially encrypted communications or secure inter-process signaling."
}