CVE-2026-2311

IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by an invalid IBM i Web Administration GUI authorization check. A malicious actor could cause user-controlled code to run with administrator privilege.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7269560	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:ibm:i:7.2:::::::*
	cpe:2.3:o:ibm:i:7.3:::::::*
	cpe:2.3:o:ibm:i:7.4:::::::*
	cpe:2.3:o:ibm:i:7.5:::::::*
	cpe:2.3:o:ibm:i:7.6:::::::*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) IBM i 7.6, 7.5, 7.4, 7.3 y 7.2 es vulnerable a la escalada de privilegios causada por una comprobación de autorización no válida de la GUI de administración web de IBM i. Un actor malicioso podría hacer que código controlado por el usuario se ejecute con privilegios de administrador.

Information

Published : 2026-04-30 22:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-2311

Mitre link : CVE-2026-2311

CVE.ORG link : CVE-2026-2311

JSON object : View

Products Affected

ibm

i

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-2311", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2311", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-01T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.2.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "i", "versions": [{"status": "affected", "version": "7.6.0", "versionType": "semver", "lessThanOrEqual": "2.3.0"}, {"status": "affected", "version": "7.5.0"}, {"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.3.0"}, {"status": "affected", "version": "7.2.0"}]}]}], "published": "2026-04-30T22:16:25.147", "references": [{"url": "https://www.ibm.com/support/pages/node/7269560", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by an invalid IBM i Web Administration GUI authorization check. \u00a0A malicious actor could cause user-controlled code to run with administrator privilege."}, {"lang": "es", "value": "IBM i 7.6, 7.5, 7.4, 7.3 y 7.2 es vulnerable a la escalada de privilegios causada por una comprobaci\u00f3n de autorizaci\u00f3n no v\u00e1lida de la GUI de administraci\u00f3n web de IBM i. Un actor malicioso podr\u00eda hacer que c\u00f3digo controlado por el usuario se ejecute con privilegios de administrador."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ibm:i:7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD871157-2BB3-4641-B84E-3EA13D24D35A"}, {"criteria": "cpe:2.3:o:ibm:i:7.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A49E8C5-7967-42AE-A787-C533D24A63D7"}, {"criteria": "cpe:2.3:o:ibm:i:7.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "92D03306-B6C9-403E-99A2-CE9D8DC3B482"}, {"criteria": "cpe:2.3:o:ibm:i:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7CCB5BF-08EF-472F-A663-5DE270234F10"}, {"criteria": "cpe:2.3:o:ibm:i:7.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFFF96C2-7E0F-4DF9-AF51-3EE357D51095"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}