Description
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication.
Published: 2026-08-13
Score: 7.3 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The issue is an authentication bypass in IBM i's Navigator for i module that allows a remote attacker to obtain sensitive system information. The vulnerability is classified as CWE-287 and leads to the disclosure of confidential data.

Affected Systems

IBM i releases 7.6, 7.5, 7.4, and 7.3 are affected. Updating the Navigator for i component with the official PTFs—SJ10887 for 7.6, SJ10888 for 7.5, SJ10890 for 7.4, and SJ10891 for 7.3—removes the flaw.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.3, indicating high severity. EPSS data is not available and it is not listed in the CISA KEV catalog. Likely exploitation requires network access to the Navigator for i interface, where the attacker can bypass authentication to read sensitive data. The flaw’s low exploitation complexity increases the risk for exposed systems.

Generated by OpenCVE AI on August 13, 2026 at 21:49 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now. IBM i Release5770-SS1 Option 3 PTF Number(s)PTF Download Link(s)7.6SJ10887 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10887 7.5SJ10888 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10888 7.4SJ10890 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10890 7.3SJ10891 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10891 IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.

OpenCVE Recommended Actions

  • Apply the IBM i Platform Fix Toolkit updates SJ10887 for version 7.6, SJ10888 for 7.5, SJ10890 for 7.4, and SJ10891 for 7.3 to resolve the authentication bypass.
  • Restrict external network access to Navigator for i components by configuring firewalls or VPNs so that only authorized administrators can reach it.
  • Enforce strong password policies and disable unsupported authentication methods to reduce the risk of credential compromise.

Generated by OpenCVE AI on August 13, 2026 at 21:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication.
Title IBM i is Affected By Multiple Vulnerabilities in Navigator for i
First Time appeared Ibm
Ibm i
Weaknesses CWE-287
CPEs cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm i
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

Subscriptions

Ibm I
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-13T20:26:40.264Z

Reserved: 2026-07-24T15:08:37.636Z

Link: CVE-2026-17099

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-13T21:17:42.033

Modified: 2026-08-13T21:17:42.033

Link: CVE-2026-17099

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T22:00:05Z

Weaknesses