An improper authentication flaw in IBM i allows a remote authenticated attacker to bypass security controls. A valid user can obtain elevated privileges or disrupt the operating system, compromising confidentiality, integrity, or availability of data and services. The weakness is classified as CWE‑287.

IBM i releases 7.3 through 7.6 are impacted. Users of these versions must verify whether their installation is current or already includes an update.

The vulnerability scores a CVSS of 4.3, indicating moderate severity, and no EPSS score is publicly available. It is not listed in the CISA KEV catalog. Exploitation requires an authenticated session and likely relies on existing user credentials; the attacker can then manipulate system settings or access protected resources. Attackers may employ credential theft or reuse valid credentials to take advantage of the flaw.