CVE-2026-93744 in IBM
Summary
by MITRE • 10/21/2026
IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability to alter server-side session security state.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability in IBM i operating systems versions 7.3 through 7.6 represents a critical failure in access control mechanisms within the Navigator for i web-based management interface. This flaw allows an unauthenticated remote attacker to manipulate the internal security state of server-side sessions before any legitimate user authentication has occurred. The core technical issue stems from improper validation and enforcement of session states, specifically allowing external inputs via HTTP requests to alter critical security parameters without requiring prior credentials. By sending a specially crafted HTTP request to any URL within the Navigator application, an attacker can exploit this logic error to bypass standard security restrictions that are typically enforced after authentication steps.
From a technical perspective, this vulnerability is classified under CWE-284 Improper Access Control and aligns with ATT&CK technique T1078 Valid Accounts or potentially T1136 Create Account depending on the specific exploitation path used to maintain persistence. The attacker leverages the fact that certain session management functions do not adequately verify whether a user has been authenticated before allowing modifications to security-related attributes. This misconfiguration enables the manipulation of server-side state, effectively tricking the application into treating an unauthenticated request as if it originated from a privileged or trusted context. Such behavior undermines the fundamental principle of least privilege and allows for unauthorized access to administrative functions that should be restricted to verified users only.
The operational impact of this vulnerability is severe, as it grants remote attackers the ability to bypass security restrictions without needing valid credentials. Once an attacker successfully alters the server-side session security state, they may gain elevated privileges within the Navigator interface. This could lead to unauthorized configuration changes, data exfiltration, or further exploitation of other system components that rely on accurate access control states. The lack of authentication requirement for this specific attack vector significantly lowers the barrier to entry for malicious actors, making it a high-risk vulnerability that can be exploited by automated tools with minimal effort.
Mitigation strategies must focus on immediate patching and configuration hardening. IBM has released updates addressing these flaws in subsequent service levels for IBM i 7.3, 7.4, 7.5, and 7.6 organizations should apply the latest available fixes to ensure that session management logic correctly enforces authentication requirements before processing any requests that modify security states. Additionally, administrators should restrict access to the Navigator interface using network-level controls such as firewalls or VPNs to limit exposure to untrusted networks until patches are applied. Implementing strict input validation and ensuring that all administrative endpoints require explicit authentication checks can further reduce the risk of similar access control bypasses in related applications.