Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority threads.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-12T18:17:26.680Z",
  "pubdate": "2026-08-12T18:17:26.680Z",
  "executiveSummary": "A privilege escalation vulnerability exists in IBM i versions 7.6, 7.5, 7.4, and 7.3 that could allow a remote authenticated attacker to elevate their access privileges.\nThe vulnerability stems from improper authorization controls implemented during the management and processing of high-authority threads within the operating system.\nSuccessful exploitation of this security flaw grants an unauthorized actor the ability to execute operations with elevated privileges, severely undermining the integrity and confidentiality of the affected system.\nAttackers must possess valid authentication credentials to interact with the target system and initiate the exploitation vector, indicating that the threat typically manifests as a post-compromise or insider risk scenario.\nThe risk implications include unauthorized access to sensitive system resources, modification of critical operating system configurations, and potential full system compromise.\nMitigation requires applying official vendor-supplied security updates and adhering to strict principle-of-least-privilege practices regarding user accounts and thread execution permissions.",
  "technicalDetails": "The vulnerability resides in the core authorization engine of IBM i versions 7.6, 7.5, 7.4, and 7.3, specifically within the subsystem responsible for managing high-authority threads.\nThe root cause is improper authorization validation when handling execution threads that possess elevated security attributes.\nDue to insufficient access control checks, the operating system fails to adequately verify whether an interacting authenticated user possesses the requisite security clearance to manipulate or inherit the context of high-authority threads.\nThe exploitation method relies on the attacker establishing an authenticated session with the target IBM i instance and interacting with vulnerable system interfaces or application programming interfaces that spawn or manage execution threads.\nBy manipulating thread creation, delegation, or inter-thread communication parameters, an attacker can craft malicious requests that trick the operating system into associating the attacker's execution context with a high-authority thread.\nStep-by-step, the attack flow begins with the authenticated user identifying a valid entry point or service capable of processing threaded operations.\nThe attacker then submits specially crafted inputs designed to bypass standard authorization checks during thread context switching or creation.\nUpon successful processing by the vulnerable component, the system improperly grants the attacker's process or thread the elevated capabilities associated with high-authority threads.\nPost-exploitation impact includes the execution of arbitrary administrative commands, manipulation of system-level objects, access to protected databases, and the ability to provision secondary rogue administrative accounts.\nThe vulnerability requires remote network exposure where services accepting authenticated user requests are accessible, alongside valid authentication credentials to meet the prerequisite access conditions."
}