Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper management of thread authority swaps.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T21:17:44.550Z",
  "pubdate": "2026-08-13T21:17:44.550Z",
  "executiveSummary": "A privilege escalation vulnerability exists in IBM i 7.6, 7.5, 7.4, and 7.3 that could enable a local attacker to acquire elevated privileges.\nThe vulnerability stems from improper management of thread authority swaps within the operating system architecture.\nSuccessful exploitation requires local access to the target system and appropriate capabilities to execute operations that interact with thread-level security contexts.\nAn authenticated local adversary can leverage this flaw to bypass standard authorization checks and escalate their execution context to higher privilege levels.\nThe potential impact includes unauthorized access to sensitive system resources, modification of critical configurations, and full compromise of the affected operating system environment.\nRisk implications are significant for multi-tenant or multi-user environments where local user accounts are provisioned, as system integrity and confidentiality can be severely undermined by unauthorized privilege escalation.\nMitigation requires applying the appropriate vendor-supplied security fixes and adhering to principle of least privilege hardening practices for local user accounts.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure handling and management of thread authority swaps within the IBM i operating system kernel and security subsystem.\nThread authority swaps are mechanisms designed to temporarily alter the security profile or user profile context of a executing thread to perform specific authorized tasks.\nDue to improper validation, tracking, or restoration of security attributes during these thread context switches, an attacker can manipulate or retain elevated authorization tokens beyond their intended scope.\nAffected products include IBM i version 7.6, version 7.5, version 7.4, and version 7.3.\nExploitation requires local access to the system, meaning the attacker must already possess a valid user session or the ability to execute code locally.\nNetwork exposure is not strictly required for the primary exploitation vector, as the attack relies on local system interfaces and APIs responsible for thread and process management.\nPrivilege requirements involve a local user account capable of invoking specific system functions or constructing crafted sequences of operations that trigger the improper thread authority swap behavior.\nThe step-by-step attack flow involves: first, the local attacker establishes a execution context on the target IBM i system; second, the attacker initiates a sequence of operations designed to interact with the thread authority swap mechanism; third, due to the flaw in authority management, the operating system fails to properly restrict or revert the security context; and fourth, the attacker successfully executes subsequent instructions under the inappropriately retained elevated privilege level.\nPost-exploitation impact allows the adversary to perform unauthorized administrative actions, access restricted system files, manipulate system objects, and compromise the overall security posture of the IBM i environment."
}