Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to a race condition.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-12T18:17:28.253Z",
  "pubdate": "2026-08-12T18:17:28.253Z",
  "executiveSummary": "A race condition vulnerability has been identified in IBM i versions 7.3, 7.4, 7.5, and 7.6.\nThis security flaw enables a remote authenticated attacker to bypass established security restrictions and acquire sensitive information from the underlying system.\nThe vulnerability stems from improper synchronization during concurrent operations, allowing threat actors to exploit timing windows within vulnerable components.\nSuccessful exploitation requires the attacker to possess authenticated access to the target environment, which limits unauthenticated external exposure but increases risk from internal threats or compromised accounts.\nThe primary business and operational risks include unauthorized data disclosure and the circumvention of access control boundaries, potentially leading to further privilege escalation or system compromise.\nOrganizations operating affected IBM i systems must review vendor advisories and apply available patches or configuration updates to mitigate exploitation risks.",
  "technicalDetails": "The vulnerability is classified as a race condition, occurring when multiple threads or processes access shared resources concurrently without proper synchronization or locking mechanisms.\nSpecifically, the flaw manifests within internal operational routines of IBM i 7.3, 7.4, 7.5, and 7.6, where asynchronous execution paths create exploitable timing windows.\nAn attacker must establish an authenticated session against the target system to initiate the attack flow.\nBy systematically dispatching concurrent requests designed to overlap with specific internal state transitions, the attacker forces a race condition condition.\nThis asynchronous collision disrupts the expected sequence of security checks, allowing the execution flow to bypass standard authorization validations.\nAs a direct consequence of this security control bypass, the authenticated attacker gains unauthorized read access to sensitive system information that should otherwise be restricted based on their privilege level.\nThe attack vector operates over the network leveraging supported remote communication protocols, assuming the adversary possesses valid credentials to interact with vulnerable services.\nPost-exploitation impact includes the exposure of confidential data, which can be leveraged by the attacker to map the internal architecture, harvest additional credentials, or facilitate subsequent attack phases within the IBM i environment."
}