IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.
**Risk verdict:** Treat this as a high-impact privilege-escalation risk and expedite remediation, but the supplied data does not establish active exploitation or a priority-one trigger.
**Why this matters:** A low-privileged account could potentially gain system-level authority, enabling access to sensitive business data, unauthorised changes, or disruption of critical services. This is especially consequential where the platform supports core transaction processing or regulated workloads.
**Most likely attack path:** An attacker needs local access and a valid account with limited privileges; no user interaction is required, and exploitation is rated low complexity. Scope is unchanged, but the resulting authority could permit broad control of the host and its workloads.
**Who is most exposed:** Organisations running this platform for core business applications, databases, or operational workloads are most exposed, particularly where many users or services have local accounts.
Review security audit records for unexpected authority changes or privilege elevation.
Alert on use of QSECOFR-level authority by unusual accounts, jobs, or at unusual times.
Investigate newly created or modified profiles, adopted authorities, and suspicious batch jobs.
Correlate interactive sign-ons with privileged commands and subsequent file or configuration changes.
Mitigation and prioritisation
Apply the vendor’s release-specific corrective PTF after testing in a representative environment.
Restrict local accounts and privileged authorities; disable stale accounts and review service profiles.
Increase auditing of privileged actions and protect logs from alteration.
Check the vendor advisory for current exploitation status; KEV, SSVC, PoC, and EPSS signals were not supplied.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
