CVE-2026-2311 is a medium severity flaw (CVSS 6.4) in IBM i. An invalid authorization check in the Web Administration GUI could let a malicious actor cause user controlled code to run with administrator privilege. IBM published PTF fixes for releases 7.2 through 7.6, and it recommends applying them now.
What's affected
IBM lists IBM i 7.6, 7.5, 7.4, 7.3 and 7.2, with the affected licensed program 5770DG1.
The fixes are program temporary fixes for 5770DG1, per release:
- 7.6: SJ08417
- 7.5: SJ08418
- 7.4: SJ08419
- 7.3: SJ08604
- 7.2: SJ08818
IBM lists no workaround or mitigation, so the PTF is the only remedy in the bulletin. IBM also recommends that anyone on an unsupported release upgrade to a supported, fixed version.
How to check if you're exposed
Find out whether 5770DG1 is installed and whether the PTF for your release is applied. On an IBM i session you can display installed fixes for the licensed program with a command such as:
DSPPTF LICPGM(5770DG1)
Confirm the PTF number for your release appears with an applied status. If you do not use the Web Administration GUI, confirm that the HTTP administration server is not started, since that limits who can reach the flawed check. The IBM bulletin is the authority on details.
What to do now
- Identify every IBM i partition you run and its release.
- Download and apply the PTF listed for your release, following your change process.
- Limit who can sign in to the Web Administration GUI to the smallest set of administrators.
- Plan an upgrade for any partition on an unsupported release.
Why it matters
The weakness is CWE-284 (Improper Access Control). The GUI performed an authorization check that did not do its job, so a person with limited rights could end up running code with higher ones.
The CVSS vector in IBM's bulletin lists high privileges required and user interaction required, which explains why the score is medium. That does not make it unimportant, because the outcome is administrator level code execution on a system that often runs core business workloads. Treat it as a routine but prompt patch. The record does not mark this CVE as exploited in the wild.
Quick check
Why is the severity only medium?
The bulletin vector requires high privileges and user interaction, and the attack is rated complex.
Is there a workaround?
IBM lists none. Apply the PTF.
Sources
Last reviewed: 19 October 2026.
