{"id":"CVE-2026-102917","kind":"vulnerability","aliases":["CVE-2026-102917"],"related":[],"title":"IBM i: authenticated user can gain QSECOFR security officer privileges","description":"IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.","summary":"IBM i versions 7.3 through 7.6 let a logged-in user raise their privileges. An attacker who exploits it can act with QSECOFR (security officer) authority on the system.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm i","fixed":[],"affected":"= 7.3","ecosystem":"vendor"},{"name":"ibm i","fixed":[],"affected":"= 7.4","ecosystem":"vendor"},{"name":"ibm i","fixed":[],"affected":"= 7.5","ecosystem":"vendor"},{"name":"ibm i","fixed":[],"affected":"= 7.6","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["as400","ibm-i","infrastructure","on-prem"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-16T19:17:01+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:10:17+00:00","updated_at":"2026-10-25T03:10:17+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:10:17Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"IBM i: authenticated user can gain QSECOFR security officer privileges","impact":"high","summary":"IBM i versions 7.3 through 7.6 let a logged-in user raise their privileges. An attacker who exploits it can act with QSECOFR (security officer) authority on the system.","category":"infrastructure","nicknames":[],"who_cares":["ibm-i","as400","on-prem"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker gains security officer authority and full control of the system.","analyst_note":"Find the IBM security bulletin for CVE-2026-102917 to get the fixed PTF levels per release and any check for affected configuration.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Any IBM i 7.3, 7.4, 7.5 or 7.6 system where users can log in. The sources do not list fixed releases or PTFs, so unknown. Systems where no untrusted users have accounts are lower risk, but the sources do not say that removes exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00055,"input_tokens":3396,"output_tokens":420,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102917':13A,16A '-2026':12A,15A '7.3':36B,65C '7.4':66C '7.5':67C '7.6':38B,69C 'act':54B 'actor':81C 'as400':25B 'attack':49B,75C 'authent':3A,74C 'author':59B,91C 'bad':80C 'could':82C 'cve':11A,14A 'elev':76C 'exploit':51B,83C 'gain':6A 'i':18A,20A,22A,24A 'ibm':1A,17A,19A,21A,23A,27B,33B,63C 'ibm-i':26B 'infrastructur':29B 'let':39B 'log':42B 'logged-in':41B 'offic':9A,58B 'on-prem':30B 'oper':88C 'perform':87C 'prem':32B 'privileg':10A,47B,78C 'qsecofr':7A,56B 'qsecofr/root':90C 'rais':45B 'secur':8A,57B 'system':62B,94C 'user':4A,44B 'version':35B 'vulner':71C,85C","nicknames":[],"mitigations":[],"who_affected":"Any IBM i 7.3, 7.4, 7.5 or 7.6 system where users can log in. The sources do not list fixed releases or PTFs, so unknown. Systems where no untrusted users have accounts are lower risk, but the sources do not say that removes exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T19:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102917","severity":null,"published_at":"2026-10-16T19:17:01+00:00","modified_at":"2026-10-23T16:05:55+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}