Description

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-12T17:17:25.790Z",
  "pubdate": "2026-08-12T17:17:25.790Z",
  "executiveSummary": "A privilege escalation vulnerability has been identified in IBM i versions 7.6, 7.5, 7.4, and 7.3 within the Navigator for i component.\nThis security flaw allows an authenticated user to inappropriately elevate their execution privileges to those of the root user.\nSuccessful exploitation of this vulnerability enables the execution of arbitrary commands with the highest level of system privileges, posing severe risks to confidentiality, integrity, and availability.\nThe attacker is required to possess prior authentication to the system to interact with the vulnerable Navigator for i interface.\nThe implication of this flaw is a complete compromise of the underlying operating system, as root privileges grant unrestricted access to all system resources, sensitive data, and administrative controls.\nMitigation requires applying vendor-supplied security fixes or adhering to administrative advisories released by IBM for the affected product versions.",
  "technicalDetails": "The vulnerability resides within the Navigator for i component of IBM i, specifically affecting versions 7.6, 7.5, 7.4, and 7.3.\nThe root cause stems from improper authorization checks or insecure handling of user sessions and request parameters within the administrative interface.\nAn authenticated user, operating under standard or limited user privileges, can interact with the vulnerable component to manipulate internal privilege boundaries.\nThe attack flow begins when the authenticated actor submits a specially crafted request or command sequence to the Navigator for i service.\nDue to insufficient validation of authorization tokens or administrative rights enforcement, the underlying system improperly trusts the incoming request context.\nThis failure allows the execution context to transition from a low-privileged user session to the root security officer or root user profile.\nOnce the privilege boundary is bypassed, the attacker achieves post-exploitation capabilities including the execution of arbitrary operating system commands with root privileges.\nThe network exposure includes the ports and interfaces utilized by Navigator for i, requiring the attacker to have network connectivity to the management interface along with valid user credentials.\nNo specific payload behavior beyond standard command execution primitives is explicitly detailed, but root-level access inherently permits full system instrumentation, data exfiltration, service manipulation, and installation of persistent backdoors."
}