Description

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component. An authenticated attacker can execute a maliciously planted script with root authority.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-12T18:17:28.723Z",
  "pubdate": "2026-08-12T18:17:28.723Z",
  "executiveSummary": "IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a privilege escalation vulnerability resulting from a remote code execution flaw within the activation engine component.\nThe vulnerability allows an authenticated attacker to execute maliciously planted scripts with root authority, posing severe risks to system confidentiality, integrity, and availability.\nExploitation requires authentication and the ability to introduce a malicious script into the environment, after which the compromised activation engine processes execute the payload under the highest privilege level.\nThe implications of successful exploitation include total system compromise, unauthorized administrative access, and potential persistence mechanisms established across the affected IBM i operating system instances.",
  "technicalDetails": "The vulnerability resides within the activation engine component of IBM i, specifically affecting versions 7.6, 7.5, 7.4, and 7.3.\nThe root cause stems from insecure handling and execution of scripts by the activation engine, which fails to properly validate or sanitize execution inputs and contextual file paths during processing.\nThe attack flow requires an authenticated adversary to first place a maliciously crafted script within a location or mechanism accessible to the activation engine component.\nUpon triggering or during routine operational execution cycles of the activation engine, the vulnerable component processes the planted script.\nDue to improper authorization and execution contexts within the component, the script is executed with root authority rather than restricted privileges.\nNetwork exposure and authentication requirements dictate that the attacker must possess valid credentials to access the system and prepare the attack vector.\nThe payload behavior involves arbitrary command execution within the privileged context of the root user.\nThe post-exploitation impact includes complete administrative control over the operating system, allowing the adversary to modify system configurations, access sensitive data, disable security controls, or establish persistent unauthorized access across the enterprise environment."
}