Description
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.
Published: 2026-08-13
Score: 8.3 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from improper authentication in IBM i Navigator for i, allowing a remote attacker to bypass authentication and execute arbitrary code or retrieve sensitive data. This weakness, classified as CWE-287, could lead to full system compromise.

Affected Systems

The affected products are IBM i releases 7.3, 7.4, 7.5, and 7.6. IBM provides platform firmware updates (PTFs) to remediate the issue: SJ10887 for 7.6, SJ10888 for 7.5, SJ10890 for 7.4, and SJ10891 for 7.3. No additional version information is provided beyond these releases.

Risk and Exploitability

The CVSS score of 8.3 indicates high severity. EPSS is not available, so no quantified exploitation probability is given, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote exploitation via the Navigator for i service; an attacker needs network access to the system and the ability to interact with the service. This lack of authentication control allows arbitrary code execution and data exposure.

Generated by OpenCVE AI on August 13, 2026 at 21:48 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now. IBM i Release5770-SS1 Option 3 PTF Number(s)PTF Download Link(s)7.6SJ10887 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10887 7.5SJ10888 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10888 7.4SJ10890 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10890 7.3SJ10891 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10891 IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.

OpenCVE Recommended Actions

  • Apply the relevant PTFs (SJ10887, SJ10888, SJ10890, SJ10891) to the respective IBM i releases.
  • Restrict access to Navigator for i by limiting exposure to trusted networks and enforce secure communication channels.
  • Monitor system and audit logs for authentication anomalies, and enforce strong, multi‑factor authentication where possible.

Generated by OpenCVE AI on August 13, 2026 at 21:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.
Title IBM i is Affected By Multiple Vulnerabilities in Navigator for i
First Time appeared Ibm
Ibm i
Weaknesses CWE-287
CPEs cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm i
References
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Subscriptions

Ibm I
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-13T20:27:28.496Z

Reserved: 2026-07-24T15:13:27.990Z

Link: CVE-2026-17101

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-13T21:17:42.160

Modified: 2026-08-13T21:17:42.160

Link: CVE-2026-17101

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T22:00:05Z

Weaknesses