CVE-2026-2311
Published: 30 April 2026
Summary
CVE-2026-2311 is a medium-severity Improper Access Control (CWE-284) vulnerability in Ibm I. Its CVSS base score is 6.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-2311 is a privilege escalation vulnerability in IBM i versions 7.6, 7.5, 7.4, 7.3, and 7.2, stemming from an invalid authorization check in the IBM i Web Administration GUI. This flaw, associated with CWE-284 (Improper Access Control), allows a malicious actor to execute user-controlled code with administrator privileges. The vulnerability was published on 2026-04-30 with a CVSS v3.1 base score of 6.4 (AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H).
Exploitation requires an attacker with high privileges (PR:H) on the target system, network access (AV:N), high attack complexity (AC:H), and user interaction (UI:R), such as a victim clicking a malicious link or element in the Web Administration GUI. Successful exploitation grants high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H), enabling the attacker to escalate privileges and run arbitrary code as an administrator without changing the scope (S:U).
IBM's security advisory at https://www.ibm.com/support/pages/node/7269560 provides details on mitigation, including recommended patches for affected IBM i releases.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26440
Vulnerability details
IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by an invalid IBM i Web Administration GUI authorization check. A malicious actor could cause user-controlled code to run with administrator privilege.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to exploitation of improper authorization for privilege escalation to admin code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly mitigating the invalid authorization check in the IBM i Web Administration GUI that enables privilege escalation.
Requires identification, reporting, and correction of system flaws like this authorization vulnerability, aligning with IBM's recommended patches to prevent exploitation.
Employs least privilege to restrict high-privilege users (PR:H required for exploitation), limiting the potential for escalation to administrator privileges in the Web GUI.