Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-04T17:16:56.150Z",
  "pubdate": "2026-09-04T17:16:56.150Z",
  "executiveSummary": "A critical security vulnerability has been identified within IBM i versions 7.3, 7.4, 7.5, and 7.6 regarding the improper validation of client-supplied authentication parameters.\nThis flaw allows a remote, unauthenticated attacker to bypass established security controls and gain unauthorized access to the system.\nThe vulnerability type pertains to improper input validation during the authentication handshake process.\nThe impact of successful exploitation is significant, potentially resulting in full system compromise, unauthorized data access, or the execution of arbitrary commands with elevated privileges.\nGiven that the vulnerability is exploitable remotely, the risk profile is categorized as high, necessitating immediate administrative attention.\nAttackers do not require pre-existing user credentials to initiate the exploitation vector, making it a severe threat to exposed IBM i environments.\nEffective mitigation relies on applying relevant security patches provided by IBM and restricting network access to sensitive IBM i services.",
  "technicalDetails": "The vulnerability resides in the authentication framework utilized by IBM i operating systems across versions 7.3 through 7.6. The root cause is categorized as an improper validation of client-supplied parameters during the authentication sequence, where the system fails to sufficiently verify the integrity or legitimacy of data provided by the client before establishing a session.\nIn a standard authentication flow, the IBM i operating system expects defined parameters from a client attempting to access system services. Due to this flaw, an attacker can craft specifically malformed or manipulated authentication payloads that bypass the standard validation logic. By supplying crafted input, the attacker effectively tricks the service into accepting a fraudulent authentication state, granting unauthorized access without valid credentials.\nThe attack flow initiates with the attacker identifying a network-exposed service on the target IBM i system that utilizes the flawed authentication routine. The attacker establishes a connection to this service and submits a malicious authentication packet. Because the underlying code performs insufficient sanitization or validation of the input parameters, the authentication logic proceeds to authorize the session based on the attacker's supplied data. This grants the attacker the same rights and permissions as a successfully authenticated user.\nThe scope of this vulnerability covers multiple core system versions (7.3, 7.4, 7.5, 7.6), indicating a systemic issue in how authentication handshakes are processed across these iterations. The exploitation is entirely remote, meaning no local access or physical presence is required, significantly increasing the potential attack surface. Post-exploitation, the impact is severe; depending on the service targeted, an attacker could escalate privileges, manipulate system configuration, exfiltrate sensitive database information, or deploy malicious payloads within the IBM i environment.\nThis vulnerability highlights a critical failure in the trust boundary between the client-supplied authentication parameters and the server-side validation engine, allowing for a bypass of the authentication mechanism by manipulating the input data to satisfy the server's internal checks."
}