Executive brief
IBM i, an operating system used for critical business applications and databases, contains a vulnerability that could allow a standard user to gain administrative control. By exploiting a flaw in how the system searches for software libraries, an attacker can run their own malicious code with the highest level of system authority. This could lead to full system compromise, unauthorized data access, or disruption of business operations.
Technical details
IBM i is vulnerable to privilege escalation (CWE-427: Uncontrolled Search Path Element) due to an unqualified library call. The vulnerability exists because the system does not specify the full path when calling certain libraries, allowing an attacker to place a malicious library in a location that is searched before the legitimate one. An authenticated attacker with network access can exploit this to execute arbitrary code with administrative (root-level) privileges. IBM has released Program Temporary Fixes (PTFs) for all affected versions (7.3, 7.4, 7.5, and 7.6) to remediate the issue.
Affected products
- IBM IBM i 7.3, 7.4, 7.5, 7.6
Timeline
- 2026-06-09: disclosed: Initial publication by IBM
- 2026-06-11: advisory: NVD publication date