CVE-2025-33122: IBM i Privilege Escalation Vulnerability

CVE-2025-33122 Overview

CVE-2025-33122 affects IBM i versions 7.2, 7.3, 7.4, 7.5, and 7.6. The flaw resides in IBM Advanced Job Scheduler for i, which performs an unqualified library call. An authenticated user can place a malicious object in a library that resolves ahead of the intended one in the library list. When the scheduler invokes the call, the attacker-supplied code executes with administrator privilege.

The weakness is classified as [CWE-427] Uncontrolled Search Path Element. IBM published a fix and advisory under support note 7237040.

Critical Impact
A low-privileged IBM i user can escalate to administrator and run arbitrary code by hijacking the library resolution order used by the Advanced Job Scheduler.

Affected Products

IBM i 7.2 and 7.3
IBM i 7.4 and 7.5
IBM i 7.6

Discovery Timeline

2025-06-17 - CVE-2025-33122 published to NVD
2025-07-03 - Last updated in NVD database

Technical Details for CVE-2025-33122

Vulnerability Analysis

IBM Advanced Job Scheduler for i invokes a program or service program without a fully qualified library name. On IBM i, unqualified calls resolve through the job's library list (*LIBL). An attacker who can influence the library list, or who can write to any library that precedes the intended one, can substitute a malicious object with the same name. The scheduler then loads and executes the attacker's object instead of the legitimate code.

Because the scheduler runs with administrator-level authority, the substituted code inherits those privileges. The result is privilege escalation from a standard user profile to administrator. The attack is authenticated and requires a degree of environmental control, which is reflected in the high attack complexity rating.

Root Cause

The root cause is an uncontrolled search path element [CWE-427]. The scheduler issues an unqualified CALL or program reference instead of binding the target object to a specific library using the library/object syntax. This relies on the runtime library list for resolution, which is influenceable by lower-privileged users in many configurations.

Attack Vector

Exploitation requires a valid IBM i user profile with the ability to create objects in a library that appears in the scheduler job's library list. The attacker creates a program object using the same name as the legitimate target, places it earlier in resolution order, and waits for or triggers the scheduler activity. When the unqualified call executes, control transfers to the attacker's program under administrator authority.

No public proof-of-concept exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-33122

Indicators of Compromise

Creation of program (*PGM) or service program (*SRVPGM) objects in user-writable libraries whose names match Advanced Job Scheduler components.
Unexpected modifications to the system or job library list (QSYSLIBL, QUSRLIBL) preceding scheduled job execution.
Audit journal entries showing administrator-level actions originating from a non-administrator user profile.

Detection Strategies

Enable the IBM i security audit journal (QAUDJRN) with *PGMADP, *AUTFAIL, and *OBJMGT values to capture object creation and adopted-authority program use.
Inventory libraries referenced by Advanced Job Scheduler jobs and identify any unqualified CALL statements in job definitions.
Compare current library list configuration against a known-good baseline and alert on changes affecting scheduler jobs.

Monitoring Recommendations

Forward IBM i audit journal records to a centralized analytics platform for correlation with user activity and privilege changes.
Alert on object creation events in libraries listed before QSYS or scheduler-specific libraries in *LIBL.
Review Advanced Job Scheduler job logs for unexpected program objects loaded during execution.

How to Mitigate CVE-2025-33122

Immediate Actions Required

Apply the IBM fix referenced in IBM Support Documentation node 7237040 for each affected IBM i release.
Restrict authority on libraries that appear in scheduler library lists so that only trusted profiles can create objects.
Audit existing Advanced Job Scheduler job definitions for unqualified library references and resolve them where possible.

Patch Information

IBM released remediation guidance and PTFs covering IBM i 7.2, 7.3, 7.4, 7.5, and 7.6. Refer to IBM Support Documentation for the specific PTF identifiers and load instructions for each release.

Workarounds

Remove write and create authority for non-administrator users on any library that precedes the legitimate scheduler library in *LIBL.
Use system value QSYSLIBL and curated job library lists to ensure scheduler-related libraries resolve before user-writable libraries.
Disable or restrict Advanced Job Scheduler functionality on systems where the PTF cannot be applied immediately.

bash

# IBM i CL example: review and harden the system library list
DSPSYSVAL SYSVAL(QSYSLIBL)
DSPSYSVAL SYSVAL(QUSRLIBL)

# Revoke create authority on a sensitive library for *PUBLIC
RVKOBJAUT OBJ(QGPL) OBJTYPE(*LIB) USER(*PUBLIC) AUT(*ADD *CHANGE)

# Enable relevant auditing
CHGSYSVAL SYSVAL(QAUDCTL) VALUE('*AUDLVL *OBJAUD')
CHGSYSVAL SYSVAL(QAUDLVL) VALUE('*AUTFAIL *PGMADP *OBJMGT')