CVE-2026-102917: IBM i is Affected By An Improper Privilege Management Vulnerability

Published Oct 16, 2026

Updated

IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.

Affected Software

1 affected component

IBM IBM i=7.3, =7.4, =7.5, =7.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM i 7.6 to a version that resolves this vulnerability.
Patch SJ11832
Upgrade
Upgrade IBM i 7.5 to a version that resolves this vulnerability.
Patch SJ11775
Upgrade
Upgrade IBM i 7.4 to a version that resolves this vulnerability.
Patch SJ11833
Upgrade
Upgrade IBM i 7.3 to a version that resolves this vulnerability.
Patch SJ11841

Event History

Oct 16, 2026

CVE Published

via MITRE·06:37 PM

Data Sourced

via MITRE·06:37 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must be authenticated and have local access to an affected IBM i system. The issue does not require user interaction or complex attack conditions.

What level of access could an attacker gain?

Successful exploitation can allow the attacker to perform operations with QSECOFR/Root authority, affecting confidentiality, integrity, and availability.

Which IBM i releases are affected?

IBM i versions 7.3, 7.4, 7.5, and 7.6 are identified as affected.