CVE-2026-93744: IBM i Improper Authentication

Published Oct 20, 2026

Updated

IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability to alter server-side session security state.

Affected Software

1 affected component

IBM IBM i=7.3, =7.4, =7.5, =7.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM i Release5770-SS1 Option 3 to a version that resolves this vulnerability.
Fixed in 7.6Patch SJ11740
Upgrade
Upgrade IBM i Release5770-SS1 Option 3 to a version that resolves this vulnerability.
Fixed in 7.5Patch SJ11745
Upgrade
Upgrade IBM i Release5770-SS1 Option 3 to a version that resolves this vulnerability.
Fixed in 7.4Patch SJ11746
Upgrade
Upgrade IBM i Release5770-SS1 Option 3 to a version that resolves this vulnerability.
Fixed in 7.3Patch SJ11747

Event History

Oct 20, 2026

CVE Published

via MITRE·09:41 PM

Data Sourced

via MITRE·09:41 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to this issue?

IBM i versions 7.3, 7.4, 7.5, and 7.6 are identified as affected. Exposure requires the Navigator application to be reachable over HTTP.

What does an attacker need to exploit it?

An unauthenticated remote attacker can exploit the issue by sending a specially crafted HTTP request to any URL within the Navigator application before authentication. No credentials or user interaction are required.

What is the impact of successful exploitation?

Successful exploitation can bypass security restrictions by altering the server-side session security state. The reported impact includes limited confidentiality and integrity impact, with no availability impact indicated.