CVE-2026-93744: CWE-287 Improper Authentication
Description
IBM i versions 7.3, 7.4, 7.5, and 7.6 contain an improper authentication vulnerability (CWE-287) in the Navigator application. An unauthenticated remote attacker can send a specially crafted HTTP request to bypass security restrictions and alter server-side session security state before authentication. This vulnerability has a medium severity with a CVSS score of 6.5.
CVSS v3.1
Score 6.5medium
Affected software
IBM
cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-93744 is an improper authentication vulnerability affecting IBM i Navigator application versions 7.3, 7.4, 7.5, and 7.6. The flaw allows an unauthenticated remote attacker to bypass security restrictions by sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication. Exploitation results in alteration of the server-side session security state, potentially compromising session integrity and access control.
Potential Impact
An unauthenticated attacker can bypass authentication controls and manipulate server-side session security state in the IBM i Navigator application. This could lead to unauthorized access or privilege escalation within the affected versions. The impact is limited to confidentiality and integrity with no availability impact reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, monitor vendor communications for updates and consider restricting access to the Navigator application to trusted networks or users where feasible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- ibm
- Date Reserved
- 2026-09-18T16:03:13.170Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad7e5622cdf04f65667f8a1
Added to database: 10/20/2026, 22:04:18 UTC
Last enriched: 10/20/2026, 22:18:37 UTC
Last updated: 10/20/2026, 22:18:37 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.