CVE-2026-84414

Analyzed Analyzed - Analysis Complete

IBM i Local File Ownership Change Vulnerability

Publication date: 2026-09-29

Last updated on: 2026-10-02

Assigner: IBM Corporation

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-84414

EUVD

EUVD-2026-89202

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	i	From 7.3 (inc) to 7.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM i allows a local authenticated attacker to change ownership of arbitrary files due to improper validation of an attacker-controlled file path in the Network Authentication Service (NAS). It affects versions 7.3, 7.4, 7.5, and 7.6 of IBM i.

Detection Guidance

This vulnerability involves improper file ownership changes due to a flaw in IBM i's Network Authentication Service. Detection requires checking for unauthorized file ownership modifications and verifying PTF installations. Use IBM i commands like DSPPTF to confirm if the required PTFs (SJ11610 for 7.3, SJ11609 for 7.4, SJ11608 for 7.5, SJ11607 for 7.6) are applied. Monitor system logs for suspicious file ownership changes or unauthorized access attempts.

Impact Analysis

An attacker could exploit this to modify file ownership, potentially leading to unauthorized access, data tampering, or system disruption. The high CVSS score (7.8) indicates significant risk to confidentiality, integrity, and availability of affected systems.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements in GDPR and HIPAA. Non-compliance risks include fines and legal penalties.

Mitigation Strategies

Apply the provided PTFs for your IBM i version: SJ11610 for 7.3, SJ11609 for 7.4, SJ11608 for 7.5, or SJ11607 for 7.6. If running an unsupported version, upgrade to a supported release immediately.

Hi! I’m here to help you understand CVE-2026-84414. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70