CVE-2026-84414: IBM i Privilege Escalation Vulnerability

CVE-2026-84414 Overview

CVE-2026-84414 affects IBM i versions 7.6, 7.5, 7.4, and 7.3. The flaw allows a local authenticated attacker to change ownership of arbitrary files on the system. The root cause is improper validation of an attacker-controlled file path, categorized under [CWE-732] Incorrect Permission Assignment for Critical Resource. Exploitation requires local access with low privileges and no user interaction. Successful attacks can result in full loss of confidentiality, integrity, and availability on the affected system.

Critical Impact
A local authenticated user can reassign ownership of any file on the IBM i system, enabling privilege escalation and complete compromise of protected data and system binaries.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-09-29 - CVE-2026-84414 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-84414

Vulnerability Analysis

CVE-2026-84414 is a file permission vulnerability in IBM i that allows a local authenticated attacker to change the ownership of arbitrary files. The affected component fails to properly validate a file path supplied by the caller. Because ownership changes bypass the intended access boundaries, an attacker can take ownership of files owned by higher-privileged users, including system files. Once ownership is reassigned, the attacker can modify, replace, or delete those files. This provides a direct path from a low-privilege local account to full system compromise on IBM i.

Root Cause

The vulnerability stems from improper validation of an attacker-controlled file path [CWE-732]. The affected IBM i functionality accepts a path parameter and performs an ownership change operation without verifying that the caller is authorized to modify the target object. This design flaw allows path values that point to files outside the caller's authorization scope.

Attack Vector

Exploitation is local. The attacker must hold a valid IBM i user profile with low privileges. From an interactive shell or program call, the attacker invokes the vulnerable ownership-change path with a target file such as a system configuration file, security exit program, or an executable owned by a privileged profile. After ownership transfers to the attacker, standard file operations grant read, write, and execute control over the target. Refer to the IBM Support Documentation for vendor-supplied technical details.

Detection Methods for CVE-2026-84414

Indicators of Compromise

Unexpected changes to file ownership on IFS objects or QSYS.LIB objects, especially transitions from QSYS, QSECOFR, or other privileged profiles to standard user profiles.
Audit journal QAUDJRN entries of type CO (create), OW (ownership change), or AF (authority failure) referencing sensitive paths.
Modification of system executables, exit programs, or configuration files shortly after an ownership change event.

Detection Strategies

Enable and review IBM i security auditing with QAUDLVL including *SECURITY and *AUTFAIL to capture ownership and authority changes.
Baseline file ownership for sensitive directories in the Integrated File System and alert on deviations.
Correlate ownership-change events with the initiating job, user profile, and program name to identify anomalous callers.

Monitoring Recommendations

Forward QAUDJRN events to a centralized analytics platform for continuous monitoring and correlation across user sessions.
Alert on ownership changes performed by non-administrative profiles targeting objects owned by QSYS, QSECOFR, or application service accounts.
Monitor for follow-on activity such as file replacement, permission grants, or execution of newly owned binaries.

How to Mitigate CVE-2026-84414

Immediate Actions Required

Apply the IBM-provided PTFs referenced in the IBM Support Documentation for IBM i 7.3, 7.4, 7.5, and 7.6.
Inventory user profiles with interactive or command-line access and remove unnecessary local accounts.
Audit recent ownership changes on sensitive objects and restore expected owners where deviations are found.

Patch Information

IBM has published remediation guidance for CVE-2026-84414 covering IBM i 7.6, 7.5, 7.4, and 7.3. Administrators should consult the IBM Support Documentation for the specific PTF numbers applicable to each release and install them through standard IBM i PTF management procedures.

Workarounds

Restrict command-line access by setting LMTCPB(*YES) on user profiles that do not require program call capability.
Reduce special authorities such as *ALLOBJ and *SECADM to only those profiles that require them.
Limit access to the Integrated File System paths containing sensitive files through explicit authorization lists until patches are deployed.

bash

# Example: reduce capability on a standard user profile
CHGUSRPRF USRPRF(APPUSER) LMTCPB(*YES) SPCAUT(*NONE)

# Example: enable security auditing for ownership and authority events
CHGSYSVAL SYSVAL(QAUDCTL) VALUE('*AUDLVL *OBJAUD')
CHGSYSVAL SYSVAL(QAUDLVL) VALUE('*SECURITY *AUTFAIL')