CVE-2026-93744— IBM i Improper Authentication
Quick assessment
Affected
IBM i
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
IBM i 7.3、7.4、7.5 和 7.6 可能允许未认证的远程攻击者因访问控制不当而绕过安全限制。攻击者可在认证之前向 Navigator 应用程序中的任意 URL 发送特制的 HTTP 请求，利用此漏洞篡改服务器端的会话安全状态。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93744
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
IBM i Improper Authentication
Source: CVE Program / CVE List V5
Vulnerability Description
IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability to alter server-side session security state.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-93744
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93744
请登录查看更多情报信息。
Same Patch Batch · IBM · 2026-10-20 · 11 CVEs total
| CVE-2026-81212 | 10.0 CRITICAL | DataStage on Cloud Pak for Data Improper Authorization |
| CVE-2026-92559 | 9.8 CRITICAL | IBM App Connect Enterprise is vulnerable to a credential exposure |
| CVE-2026-76587 | 8.8 HIGH | IBM Planning Analytics Buffer Overflow |
| CVE-2026-93441 | 8.6 HIGH | IBM QRadar SIEM HTTP Receiver protocol is vulnerable to a denial of service |
| CVE-2026-93442 | 8.2 HIGH | IBM QRadar SIEM Out-of-bounds Read |
| CVE-2026-82891 | 8.1 HIGH | IBM Guardium Data Protection is affected by a security vulnerability |
| CVE-2026-93888 | 7.8 HIGH | IBM Sterling Connect:Direct for Unix Buffer Overflow |
| CVE-2026-87800 | 6.8 MEDIUM | IBM Cyber Fraud includes components with multiple known vulnerabilities |
| CVE-2026-94402 | 6.1 MEDIUM | IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation |
| CVE-2026-9825 | 3.7 LOW | IBM Cyber Fraud Reachable Assertion |
IV. Related Vulnerabilities
Same product: i
-
CVE-2026-17068
IBM i is Affected By Improper Authorization and Access Contr -
CVE-2026-17073
IBM i is Affected By Improper Authorization and Access Contr -
CVE-2026-17275
IBM i is Affected by an Improper Validation Vulnerability -
CVE-2026-17488
IBM i is Affected By An Improper Authentication Vulnerabilit -
CVE-2026-17491
IBM i is Affected By An Improper Privilege Management Vulner
Same vendor: IBM
-
CVE-2026-76587
IBM Planning Analytics Buffer Overflow -
CVE-2026-9825
IBM Cyber Fraud Reachable Assertion -
CVE-2026-81212
DataStage on Cloud Pak for Data Improper Authorization -
CVE-2026-82891
IBM Guardium Data Protection is affected by a security vulne -
CVE-2026-87800
IBM Cyber Fraud includes components with multiple known vuln
Same weakness: CWE-287
-
CVE-2026-113682
Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass -
CVE-2026-105949
Cruise-control: streams for apache kafka cruise control: aut -
CVE-2026-113469
Improper Signature Verification of Active Update Files -
CVE-2026-111090
Improper Signature Verification of Firmware Update Files -
CVE-2026-107400
Security Vulnerability identified in IBM TRIRIGA - GWT Mock
V. Comments for CVE-2026-93744
No comments yet