CVE-2026-2311: 
NixOS vulnerability analysis and mitigation

CVE-2026-2311 is a privilege escalation vulnerability in the IBM i Web Administration GUI caused by an invalid authorization check. It affects IBM i versions 7.2, 7.3, 7.4, 7.5, and 7.6. A malicious actor can exploit this flaw to cause user-controlled code to run with administrator privileges. The vulnerability was published on April 30, 2026, with patches made available the same day. CVSS v3.1 scores differ by source: NVD assigns a score of 9.8 (Critical), while IBM's own scoring (as reflected in the ENISA/EUVD entry) yields 6.4 (Medium) with a more restrictive vector (GitHub Advisory, IBM Support).

The root cause is classified as CWE-284 (Improper Access Control), specifically an invalid authorization check within the IBM i Web Administration GUI component. The flaw allows the authorization mechanism to be bypassed, enabling user-controlled code to execute with administrator-level privileges. Under the NVD scoring, the attack vector is network-accessible, requires no privileges, and no user interaction — suggesting the authorization check can be bypassed remotely. IBM's own scoring indicates higher attack complexity and privilege requirements, suggesting the exploitability conditions may be more constrained in practice (GitHub Advisory, IBM Support).

Successful exploitation could result in complete system compromise of affected IBM i systems, with high impact to confidentiality, integrity, and availability. An attacker who exploits this vulnerability can execute arbitrary code with administrator privileges, potentially enabling full control over the IBM i environment, access to sensitive business data, and disruption of critical services. Given that IBM i is commonly used in enterprise and financial environments, the blast radius of a successful attack could be significant (GitHub Advisory, IBM Support).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.033–0.043%, placing it in a low percentile for near-term exploitation likelihood. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

IBM has released patches to address this vulnerability, available through IBM Support at the referenced advisory page. Administrators should apply the relevant PTFs (Program Temporary Fixes) for their IBM i version (7.2 through 7.6) as soon as possible. As an interim measure, network-level access controls should be implemented to restrict access to the IBM i Web Administration GUI to authorized personnel and trusted network segments only. Monitoring for unusual administrative activity on IBM i systems is also recommended during the patching window (IBM Support, GitHub Advisory).

Coverage of CVE-2026-2311 has been limited to automated vulnerability tracking platforms and aggregators such as VulDB, CVEfeed, and CIRCL, with no notable independent researcher commentary or significant media coverage identified. The vulnerability was noted in the IT Jungle IBM i PTF Guide shortly after disclosure (IT Jungle).