Description
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path traversal vulnerability.
Published: 2026-08-13
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a path traversal flaw in IBM i released versions 7.6, 7.5, 7.4 and 7.3 that permits a remote authenticated attacker to reference arbitrary objects, thereby exposing sensitive data or allowing modification of objects. The flaw falls under CWE‑22 and directly jeopardizes confidentiality and integrity for users with authenticated credentials.

Affected Systems

Affected systems are IBM i releases 7.3, 7.4, 7.5 and 7.6. IBM provides specific PTFs for each: SJ10841 for 7.3, SJ10840 for 7.4, SJ10835 for 7.5 and SJ10871 for 7.6.

Risk and Exploitability

The CVSS score of 8.5 indicates high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, implying no known mass exploitation. Attack requires valid credentials, so the threat surface is limited to users with privileged access, but the impact of gaining object access remains significant.

Generated by OpenCVE AI on August 13, 2026 at 21:26 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now. IBM i Release5770-SS1 PTF Number(s)PTF Download Link(s)7.6SJ10871 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10871 7.5SJ10835 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10835 7.4SJ10840 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10840 7.3SJ10841 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10841 IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.

OpenCVE Recommended Actions

  • Apply the IBM i PTF appropriate to your release (e.g., SJ10871 for release 7.6, SJ10835 for 7.5, SJ10840 for 7.4, or SJ10841 for 7.3) as soon as possible.
  • Restrict remote authenticated access to IBM i by enforcing network segmentation or VPN controls for privileged users until the patch is applied.
  • Continuously monitor audit logs for unexpected object access attempts to detect potential exploitation early.

Generated by OpenCVE AI on August 13, 2026 at 21:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Description IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path traversal vulnerability.
Title IBM i is Affected By Multiple SQL Vulnerabilities [, ]
First Time appeared Ibm
Ibm i
Weaknesses CWE-22
CPEs cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm i
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Ibm I
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-13T19:52:16.729Z

Reserved: 2026-07-24T06:22:19.843Z

Link: CVE-2026-16908

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-08-13T20:17:16.667

Modified: 2026-08-13T20:36:48.443

Link: CVE-2026-16908

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T21:30:11Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')