CVE-2026-93744

Awaiting Analysis Awaiting Analysis - Queue

IBM i Navigator Session Security Bypass

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: IBM Corporation

Description

IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability to alter server-side session security state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-93744

EUVD

EUVD-2026-106858

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	i	7.6
IBM	i	7.5
IBM	i	7.4
IBM	i	7.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated remote attacker to bypass security restrictions in IBM i systems (versions 7.3 to 7.6). By sending a specially crafted HTTP request to any URL in the Navigator application before logging in, an attacker can manipulate server-side session security settings.

Detection Guidance

This vulnerability involves improper access control in IBM i Navigator application. Detection requires monitoring for unusual HTTP requests to Navigator URLs before authentication. Check web server logs for requests to /QIBM/Navigator/ or similar paths prior to login attempts. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to alter session security states, potentially gaining unauthorized access to sensitive data or performing actions without proper authentication. This could lead to data breaches, unauthorized system changes, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply the latest IBM i security patches or updates to address the improper access control in the Navigator application. Ensure the IBM i system is updated to versions 7.3, 7.4, 7.5, or 7.6 with the necessary fixes. Restrict network access to the Navigator application until patches are applied.

Hi! I’m here to help you understand CVE-2026-93744. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...