CVE-2026-77153 in IBM
Summary
by MITRE • 11/08/2026
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to obtain sensitive information from the Host-Based Printer Subsystem due to no authorization check. A bad actor could use this vulnerability to print files they should not be able to access.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/08/2026
The IBM i operating system versions 7.6, 7.5, 7.4, and 7.3 contain a critical security flaw within the Host-Based Printer Subsystem that permits remote unauthenticated attackers to bypass authorization controls. This vulnerability stems from an insufficient access control mechanism where the subsystem fails to properly validate user permissions before processing print requests originating from external sources. In a secure environment, any attempt to interact with system resources such as printers must be preceded by rigorous authentication and authorization checks to ensure that only authorized users can initiate actions or retrieve data associated with those resources. The absence of this check creates an open pathway for malicious actors who do not possess valid credentials on the target system.
From a technical perspective, the flaw allows an attacker to exploit the printer subsystem as a vector for information disclosure. By sending specifically crafted print jobs to the vulnerable service, an adversary can force the system to process files that are normally restricted by file-level permissions or user profile restrictions. This effectively circumvents the operating system's standard security model, which relies on object authorities and job-based access controls to protect sensitive data. The attacker does not need prior knowledge of valid usernames or passwords, making this a significant risk for systems exposed to untrusted networks such as the internet or poorly segmented internal VLANs.
The operational impact of this vulnerability is primarily centered around unauthorized information disclosure. An attacker can leverage this flaw to print documents containing confidential business intelligence, personally identifiable information, financial records, or proprietary code that they should not have access to under normal circumstances. This breach of confidentiality can lead to severe regulatory compliance violations, such as GDPR, HIPAA, or PCI-DSS non-compliance, depending on the nature of the exposed data. Furthermore, the ability to print restricted files may serve as a precursor for more sophisticated attacks, including social engineering campaigns where leaked documents are used to gain further trust or access within an organization.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in authorization checks that allow unauthorized actors to perform actions they should not be permitted to do. In the context of the MITRE ATT&CK framework, this behavior corresponds to techniques used for Initial Access and Collection, where adversaries exploit misconfigurations or software flaws to gather data from local systems without detection by standard security monitoring tools. The lack of authentication required for exploitation places it in a high-severity category due to its ease of use and the broad attack surface available to remote attackers.
To mitigate this risk, organizations running affected versions of IBM i must apply the latest cumulative technology levels or specific patches provided by IBM that address the authorization logic within the Host-Based Printer Subsystem. It is also recommended to restrict network access to printer services through firewall rules if these services do not need to be accessible from untrusted networks. Implementing strict input validation and ensuring that all external-facing services adhere to the principle of least privilege can further reduce the attack surface. Regular security audits and penetration testing should be conducted to identify similar misconfigurations in other subsystems, ensuring a holistic approach to system hardening against unauthorized access attempts.