Executive brief
IBM i is an operating system for IBM Power Systems servers used in enterprise environments for business-critical applications. The vulnerability allows an authenticated local user to read privileged files through SSH, which could expose sensitive system information or configuration details. The attack requires valid login credentials and direct local access to the system.
Technical details
The vulnerability is an unsafe privilege handling issue (CWE-267) in OpenSSH on IBM i that permits a local authenticated attacker to access privileged files. The attack requires local access and valid authentication credentials; the attacker cannot escalate privileges or modify system state, only read sensitive information. The vulnerability affects IBM i versions 7.5 and 7.6. IBM has released PTF patches SJ11405 (for 7.5) and SJ11404 (for 7.6) to remediate the issue.
Affected products
- IBM i 7.5, 7.6
Timeline
- 2026-09-04: disclosed