CVE-2026-7870: IBM i is Affected by Privilege Escalation []

Synopsis

A privilege escalation vulnerability affects IBM i versions 7.3 through 7.6, caused by an unqualified library call that allows user-controlled code to be substituted and executed with administrator privileges. The flaw is reachable over the network and requires only a low-privilege account to exploit, with no victim interaction needed. Successful exploitation gives an attacker full read, write, and availability control over the affected system. HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as IBM publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service is exposed over the network, so an attacker must be able to reach it remotely.

• AuthenticationRequired

  A low-privilege account is sufficient; no administrative credentials are needed to trigger the unqualified library call.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker can exploit the flaw directly.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental configuration.

Blast Radius

• A successful attacker executes arbitrary code with administrator privileges on the IBM i system.
• Confidential data stored on the system, including application data and credentials, becomes fully readable.
• The attacker can modify or delete persisted data, configuration files, and system objects.
• The attacker can crash or deny availability to services running on the affected IBM i instance.