CVE-2025-2947 is a high severity (CVSS 7.2) privilege escalation flaw in IBM i 7.6. An OS command swaps user profiles incorrectly, which lets a malicious actor gain root access to the host operating system. IBM says the fix is PTF SJ04908 for release 7.6, and that no workaround exists.
What's affected
The record and IBM's bulletin list one affected product: IBM i 7.6.
IBM's bulletin says release 7.6 is fixed by a PTF (program temporary fix) from the 5770-SS1 licensed program. The PTF number is SJ04908. The bulletin lists no workarounds or mitigations, so patching is the only path.
The CVSS vector in the record is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. In plain terms, it can be reached over the network, needs little skill, and requires high privileges before an attacker can use it. The effect on confidentiality, integrity and availability is high.
How to check if you're exposed
IBM i is not a package manager system, so there is no single command that works everywhere. Use the normal IBM i tooling your team already trusts.
- Confirm the release. If you run 7.6, you are in scope. Other releases are not listed in the bulletin.
- Check whether PTF SJ04908 is installed. On IBM i, the Display PTF (DSPPTF) command for product 5770SS1 will show the status of a PTF.
- If it is missing, find it in IBM Fix Central using the link in the bulletin.
If you cannot tell which PTFs are applied, treat the system as unpatched until you can show otherwise.
What to do now
- Identify every IBM i 7.6 partition, including development and disaster recovery systems.
- Download and apply PTF SJ04908 through your normal change process, and restart or IPL as IBM's PTF cover letter requires.
- Review who holds high privilege profiles on these systems. The flaw needs high privileges to start, so a short list of powerful accounts limits the risk.
- Check the IBM bulletin again before you close the change, in case IBM updates the fix information.
Why it matters
The weakness is CWE-278, Insecure Preserved Inherited Permissions. In this case, an OS command does not swap user profiles correctly, so privileges that should have been dropped are kept. That turns an account with high privileges into one with root level control of the host.
The privilege requirement lowers the odds of a drive-by attack, but it does not make the issue safe to ignore. Service accounts, shared administrator profiles and stolen credentials are the usual way an attacker reaches a high privilege starting point. Once the profile swap goes wrong, the host itself is at stake. The record does not mark this CVE as known exploited (it is not in the CISA KEV catalog at the time of writing).
IBM i systems often run core business workloads and stay in service for many years, which is why timely PTF discipline matters.
Quick check
Is this CVE being exploited in the wild?
The record does not flag it as a CISA Known Exploited Vulnerability, and the IBM bulletin does not say it is exploited. Keep watching the bulletin for changes.
Is there a workaround if I cannot patch right away?
IBM's bulletin lists no workarounds or mitigations. Limiting who holds high privilege profiles reduces exposure but does not fix the flaw.
Sources
Last reviewed: 19 October 2026.
