PT-2026-110984 · Ibm · Ibmi
CVE-2026-49483
·
Published
2026-10-12
·
Updated
2026-10-12
CVSS v4.0
8.9
High
| Vector | AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Code for IBMi versions prior to 3.0.1
Description
IBMi components implementing
IBMiComponent are accepted after verifying the existence of a procedure without reliably confirming component integrity. When components are installed with broad public permissions, a local account can alter programs such as GETMBRINFO. Subsequently, a connection can execute the modified program under the connecting account because the LONG COMMENT marker is insufficient to establish integrity.Recommendations
Update to version 3.0.1.
Exploit
Fix
Insufficient Verification of Data Authenticity
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ibmi