Description
IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by an invalid IBM i Web Administration GUI authorization check.  A malicious actor could cause user-controlled code to run with administrator privilege.
Published: 2026-04-30
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a privilege escalation caused by an invalid IBM i Web Administration GUI authorization check. A malicious actor can cause user‑controlled code to run with administrator privilege, potentially giving full system control. This flaw is classified as CWE‑284 and carries a CVSS score of 6.4.

Affected Systems

Affected are IBM i releases 7.2, 7.3, 7.4, 7.5 and 7.6. The specific patches are IBM i PTF SJ08818 for 7.2, SJ08604 for 7.3, SJ08419 for 7.4, SJ08418 for 7.5 and SJ08417 for 7.6, all listed by IBM as recommended mitigations.

Risk and Exploitability

The CVSS score denotes moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves accessing the Web Administration GUI over the network; an authenticated user could exploit the flawed authorization check to elevate privileges and execute arbitrary code as an administrator.

Generated by OpenCVE AI on May 1, 2026 at 04:51 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now. IBM i Release5770-DG1 PTF Number(s)PTF Download Link(s)7.6SJ08417 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ08417 7.5SJ08418 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ08418 7.4SJ08419 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ08419 7.3SJ08604 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ08604 7.2SJ08818 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ08818 IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.

OpenCVE Recommended Actions

  • Install the IBM i PTFs SJ08417 (7.6), SJ08418 (7.5), SJ08419 (7.4), SJ08604 (7.3) and SJ08818 (7.2) to correct the authorization flaw.
  • If your system runs an unsupported IBM i version, upgrade to the latest supported and fixed release of IBM i.
  • Restrict and monitor access to the IBM i Web Administration GUI, limiting connections to trusted administrators and enforcing least‑privilege principles.

Generated by OpenCVE AI on May 1, 2026 at 04:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 01 May 2026 19:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:ibm:i:7.2:*:*:*:*:*:*:*
cpe:2.3:o:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:o:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:o:ibm:i:7.5:*:*:*:*:*:*:*
cpe:2.3:o:ibm:i:7.6:*:*:*:*:*:*:*

Fri, 01 May 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Apr 2026 22:00:00 +0000

Type Values Removed Values Added
Description IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by an invalid IBM i Web Administration GUI authorization check.  A malicious actor could cause user-controlled code to run with administrator privilege.
Title IBM i is affected by a privilege escalation vulnerability in Web Administration GUI []
First Time appeared Ibm
Ibm i
Weaknesses CWE-284
CPEs cpe:2.3:a:ibm:i:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm i
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm I
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-05-02T03:55:31.329Z

Reserved: 2026-02-10T21:39:52.444Z

Link: CVE-2026-2311

cve-icon Vulnrichment

Updated: 2026-05-01T16:37:35.884Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-30T22:16:25.147

Modified: 2026-05-01T19:33:39.563

Link: CVE-2026-2311

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T05:00:12Z

Weaknesses