Brief Summary: CVE-2026-7870 — IBM i Privilege Escalation via Unqualified Library Call Affects All Supported Releases

Introduction

A low-privilege user on any supported release of IBM i can escalate to full administrator control by exploiting how the operating system resolves library references, and IBM says there are no workarounds available. CVE-2026-7870 is the third unqualified library call privilege escalation disclosed on IBM i in roughly one year. What might look like a one-off bug is a systemic weakness class, and it affects an estimated 120,000 enterprise installations worldwide.

IBM i (formerly OS/400, running on IBM Power Systems) runs mission-critical operations in finance, manufacturing, healthcare, and retail. The platform holds approximately 35.59% market share in its technology category and remains in demand in 2026 for its integrated database, object-based architecture, and reliability. A privilege escalation vulnerability on these systems carries outsized business risk because the data they process is typically among an organization's most sensitive.

Technical Information

Root Cause: Unqualified Library Calls and CWE-427

CVE-2026-7870 is classified under CWE-427: Uncontrolled Search Path Element. The vulnerability is in the IBM i base operating system, within the 5770-SS1 licensed program. Certain programs in the OS reference library objects by name alone, without specifying the fully qualified library path.

On IBM i, object resolution works through a library list, an ordered sequence of libraries that the system searches when a program calls an object without qualifying it. This is architecturally similar to the PATH environment variable on Unix/Windows systems, the DLL search order on Windows, or LD_PRELOAD on Linux. When a program calls MYSRVPGM instead of MYLIB/MYSRVPGM, the system walks the library list from top to bottom and loads the first object it finds with that name.

The CVSS 3.1 vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which gives a base score of 8.8. Each component breaks down as follows:

Attack Flow

Exploitation follows a well-understood pattern for library list hijacking on IBM i:

1. Reconnaissance: The attacker identifies a program in the IBM i base operating system that makes an unqualified library call for a service program or other object. Because the vulnerable code is in the OS itself (5770-SS1), the attacker does not need to find a flaw in a custom application. The target is a system-level program.

2. Malicious object placement: The attacker compiles or restores a malicious program object with the same name as the legitimate target into a library that appears earlier in the job's library list. This requires only basic user-level access with compile or restore capability.

3. Triggering the unqualified call: When the vulnerable system program runs and makes the unqualified call, the IBM i resolver traverses the library list and finds the attacker's malicious object first.

4. Privilege escalation: The malicious code executes with the authority of the calling program. In this case the calling program operates with administrator privilege, so the attacker's code inherits that authority. The result is full administrative control, including unrestricted ability to read, modify, or destroy data and to disrupt operations.

The network attack vector (AV:N), combined with low attack complexity and low privilege requirements, means that any authenticated user with network access to the IBM i system and the ability to compile or restore objects can exploit this vulnerability. No social engineering or additional specialized conditions are required.

Why This Matters Architecturally

The library list is a fundamental feature of IBM i, designed for flexibility and ease of development. It lets the same program resolve to different library objects depending on the job's configuration, which is useful for testing, multi-tenant environments, and version management. That flexibility becomes a security liability when system programs rely on unqualified references. Because users can control the library list, any unqualified call in a privileged program is a potential privilege escalation vector.

IBM needed four to five PTFs per release, which indicates the unqualified library call issue was present in several internal components across 5770-SS1 rather than in a single code path.

Patch Information

IBM published a security bulletin for CVE-2026-7870 on June 9, 2026. The bulletin states that no workarounds or mitigations are available, so applying the PTFs is the only remediation path.

The fix qualifies the previously unqualified library calls, so the system resolves them to the intended, known-good library location instead of relying on the user-controllable search path.

PTFs by Release

IBM shipped a distinct PTF for each affected component of the 5770-SS1 product rather than a single monolithic fix.

PTF Details

PTF SJ09688, for IBM i 7.5, is a representative example. It is categorized as an "OSP-INTERNAL SECURITY ENHANCEMENT" targeting the 5770-SS1 licensed program. It operates on the sy.xpf component and resolves internal known issue DT470876. The PTF was opened on May 13, 2026 and carries no prerequisite or corequisite PTFs. Its status is Closed COR (corrected), which confirms the fix is finalized and available for download from IBM Fix Central.

The CVE record at cve.org tags the IBM bulletin reference as both "vendor-advisory" and "patch," which independently confirms that the bulletin is a remediation.

Defense in Depth (Not a Substitute for Patching)

No official workaround exists, but MITRE's CWE-427 guidance recommends general measures that can reduce exposure to this class of vulnerability:

• Use fully qualified library references in all application code (e.g., MYLIB/MYSRVPGM rather than just MYSRVPGM).
• Restrict library list modifications so that low-privilege users cannot place libraries ahead of system libraries in the search path.
• Limit compile and restore authority by restricting CRTxxx and RSTxxx command authorities, which reduces the ability of low-privilege users to place malicious objects on the system.

These measures reduce the attack surface for future variants but do not address CVE-2026-7870 itself. Only the PTFs resolve the vulnerability in the OS code.

Affected Systems and Versions

All currently supported releases of IBM i running the 5770-SS1 licensed program (the core operating system) are affected:

• IBM i 7.6
• IBM i 7.5
• IBM i 7.4
• IBM i 7.3

This covers virtually the entire supported install base. IBM advises installations on unsupported or end-of-support releases to upgrade to a supported and fixed version, because PTFs are not produced for unsupported releases.

Vendor Security History

CVE-2026-7870 is the latest in a recurring pattern of unqualified library call privilege escalation vulnerabilities on IBM i:

Three separate unqualified library call vulnerabilities have appeared in approximately one year, all with the same CWE-427 root cause and all enabling administrator-level privilege escalation. This pattern indicates a systemic code-quality issue in IBM i development, where library references are not consistently qualified with explicit library names.

Security research firms including Silent Signal and ZeroPath have published multiple IBM i vulnerability disclosures, which shows the platform is receiving increasing scrutiny from the security research community.

For organizations with IBM i systems, the implication extends beyond this single CVE. An audit of custom and vendor applications for unqualified library calls is warranted, because each unqualified reference in a privileged program is a potential future vulnerability. Qualifying library references now, and restricting compile and restore authorities for low-privilege users, can reduce the attack surface before the next variant is disclosed.

The IBM X-Force Threat Intelligence Index 2026 reports a 44% increase in attacks exploiting public-facing applications, driven by missing authentication controls and AI-enabled vulnerability discovery. Privilege escalation flaws like CVE-2026-7870 are the type of vulnerability that attackers are accelerating their efforts to find and exploit.

References

• CVE-2026-7870 Detail (NVD)
• CVE-2026-7870 (cve.org)
• IBM Security Bulletin: IBM i is Affected by Privilege Escalation (CVE-2026-7870)
• IBM Security Bulletin (alternate link)
• IBM Fix Central: PTF SJ09688
• Vulners: IBM i Privilege Escalation Advisory
• CWE-427: Uncontrolled Search Path Element
• IBM Security Bulletin: CVE-2025-33122 (Advanced Job Scheduler)
• CVE-2025-33122 Detail (NVD)
• ZeroPath: IBM i SQL Services Privilege Escalation (CVE-2025-36367)
• SentinelOne: CVE-2025-2947 IBM i Privilege Escalation
• Silent Signal: IBM i Security Services
• IBM X-Force Threat Intelligence Index 2026
• Vigilance.fr: IBM i Privilege Escalation via Unqualified Library Call
• LANSA: Why is the AS400 Still in Demand in 2026?