{"id":"CVE-2026-93744","kind":"vulnerability","aliases":["CVE-2026-93744"],"related":[],"title":"IBM i Navigator: unauthenticated HTTP request can alter session security state","description":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability to alter server-side session security state.","summary":"IBM i 7.3 through 7.6 Navigator accepts a specially crafted HTTP request to any URL before authentication. An unauthenticated remote attacker can use it to change server-side session security state and bypass security restrictions.","severity":"medium","cvss":6.5,"epss":0.00388,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-i","ibm-navigator","infrastructure","self-hosted"],"not_affected_if":["navigator-not-installed","network-restricted"],"how_to_check":"- Confirm the IBM i release with `WRKPTFGRP` or `GO LICPGM` and compare against the affected releases 7.3, 7.4, 7.5 and 7.6\n- Check whether IBM Navigator for i is installed and reachable from untrusted networks\n- unknown for the exact PTF or Navigator build that contains the fix","fix":"- Apply the IBM PTF or Navigator update for IBM i 7.3, 7.4, 7.5 or 7.6 from IBM's security bulletin\n- Restrict access to the Navigator HTTP port to trusted networks until patched\n- unknown for the exact fixed PTF level, as the sources do not name it","status":"open","published_at":"2026-10-20T22:21:07+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:49:14+00:00","updated_at":"2026-10-25T03:49:14+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:49:14Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the IBM PTF or Navigator update for IBM i 7.3, 7.4, 7.5 or 7.6 from IBM's security bulletin\n- Restrict access to the Navigator HTTP port to trusted networks until patched\n- unknown for the exact fixed PTF level, as the sources do not name it","reach":"network","title":"IBM i Navigator: unauthenticated HTTP request can alter session security state","impact":"medium","summary":"IBM i 7.3 through 7.6 Navigator accepts a specially crafted HTTP request to any URL before authentication. An unauthenticated remote attacker can use it to change server-side session security state and bypass security restrictions.","category":"infrastructure","nicknames":[],"who_cares":["ibm-i","ibm-navigator","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker alters server-side session security state, bypassing restrictions","analyst_note":"Find the IBM security bulletin and PTF list for CVE-2026-93744 to get fixed levels and whether Navigator must be enabled by default.","how_to_check":"- Confirm the IBM i release with `WRKPTFGRP` or `GO LICPGM` and compare against the affected releases 7.3, 7.4, 7.5 and 7.6\n- Check whether IBM Navigator for i is installed and reachable from untrusted networks\n- unknown for the exact PTF or Navigator build that contains the fix","needs_analyst":true,"not_affected_if":["navigator-not-installed","network-restricted"],"who_is_affected":"IBM i systems running IBM Navigator for i on releases 7.3, 7.4, 7.5 or 7.6 are exposed, since the flaw is reached by HTTP requests to Navigator before login. Systems where Navigator is not installed or is not reachable from untrusted networks are less exposed. The sources do not say whether default configurations are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000694,"input_tokens":3383,"output_tokens":712,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-93744':14A,17A '7.3':30B,66C '7.4':67C '7.5':68C '7.6':32B,70C 'accept':34B 'access':84C 'actor':105C 'allow':72C 'alter':8A,111C 'applic':99C 'attack':48B,76C 'authent':44B,102C 'bad':104C 'bypass':61B,78C 'chang':53B 'control':85C 'could':71C,106C 'craft':37B,90C 'cve':12A,15A 'due':81C 'exploit':107C 'host':27B 'http':5A,38B,91C 'ibm':1A,19B,22B,28B,64C 'ibm-i':18B 'ibm-navig':21B 'improp':83C 'infrastructur':24B 'navig':3A,23B,33B,98C 'prior':100C 'remot':47B,75C 'request':6A,39B,92C 'restrict':63B,80C 'secur':10A,58B,62B,79C,116C 'self':26B 'self-host':25B 'send':87C 'server':55B,113C 'server-sid':54B,112C 'session':9A,57B,115C 'side':56B,114C 'special':36B,89C 'state':11A,59B,117C 'unathent':74C 'unauthent':4A,46B 'url':42B,95C 'use':50B 'vulner':109C 'within':96C","nicknames":[],"mitigations":[],"who_affected":"IBM i systems running IBM Navigator for i on releases 7.3, 7.4, 7.5 or 7.6 are exposed, since the flaw is reached by HTTP requests to Navigator before login. Systems where Navigator is not installed or is not reachable from untrusted networks are less exposed. The sources do not say whether default configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93744","severity":null,"published_at":"2026-10-20T22:21:07+00:00","modified_at":"2026-10-21T16:17:41+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-93744","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93744","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}