Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sensitive information in PASE. An attacker could exploit this vulnerability to access information about process they shouldn't be permitted to access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T16:17:21.393Z",
  "pubdate": "2026-09-04T16:17:21.393Z",
  "executiveSummary": "This vulnerability involves an information disclosure flaw within the Portable Application Solutions Environment (PASE) on IBM i platforms.\nThe issue permits an authenticated attacker to gain unauthorized access to sensitive process-related information that should be restricted based on standard operating system security policies.\nAffected versions include IBM i 7.6, 7.5, 7.4, and 7.3.\nThe risk implication is a potential breach of confidentiality, as the exposure of process metadata can facilitate reconnaissance, aid in the development of more complex exploits, or expose credentials or environment variables present in process memory spaces.\nThe vulnerability requires the attacker to be authenticated to the IBM i environment. Exploitation allows the attacker to view information regarding processes outside their authorized security scope, effectively bypassing the expected isolation mechanisms within the PASE subsystem.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper implementation of access control checks within the PASE (Portable Application Solutions Environment) subsystem of IBM i. PASE is designed to provide an AIX-based runtime environment for applications on the IBM i operating system, operating with its own process management and memory isolation mechanisms.\nIn the affected versions (7.6, 7.5, 7.4, and 7.3), the operating system fails to properly enforce process-level authorization boundaries. Specifically, the interfaces responsible for reporting process state, attributes, or environment metadata do not sufficiently validate the requester's identity or privilege level against the target process's security context.\nThe attack flow begins with an authenticated user initiating calls to system-level APIs or accessing specific filesystem nodes within the PASE environment that provide process introspection capabilities (such as the /proc filesystem or related system call interfaces). Due to the flaw, the kernel or the relevant PASE subsystem component performs insufficient validation on these requests.\nAn attacker can leverage these interfaces to enumerate and query details about processes owned by other users or the system. This allows the attacker to access sensitive information, which may include command-line arguments, environment variables, internal thread states, or memory layout details. Accessing this information is critical for an attacker because it can reveal secrets such as API keys, database connection strings, or service account tokens that are occasionally passed as process environment variables.\nFurthermore, the exposure of process memory mapping information can be leveraged to bypass address space layout randomization (ASLR) or other security controls, facilitating further exploitation of secondary vulnerabilities within the system. The lack of proper privilege checks effectively enables a local information disclosure primitive that deviates from the expected multi-user isolation standards enforced by the broader IBM i architecture.\nBecause this vulnerability is restricted to the PASE subsystem, it necessitates that the attacker already possesses a valid, authenticated session on the target IBM i system. The attack does not require network-level access beyond the initial login, but the post-exploitation impact allows for the elevation of intelligence-gathering capabilities that can compromise the integrity and confidentiality of the entire PASE environment."
}