Live › vulnerability › CVE-2026-93744
Go to dashboardIBM i 7.3 through 7.6 Navigator accepts a specially crafted HTTP request to any URL before authentication. An unauthenticated remote attacker can use it to change server-side session security state and bypass security restrictions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
IBM i systems running IBM Navigator for i on releases 7.3, 7.4, 7.5 or 7.6 are exposed, since the flaw is reached by HTTP requests to Navigator before login. Systems where Navigator is not installed or is not reachable from untrusted networks are less exposed. The sources do not say whether default configurations are affected.
No product ranges from the sources yet.
WRKPTFGRP or GO LICPGM and compare against the affected releases 7.3, 7.4, 7.5 and 7.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability to alter server-side session security state.
This page as .md · .json · in your agent: get_signal("CVE-2026-93744")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.