Introduction
On a core enterprise platform, privilege escalation can turn a contained incident into a full system compromise. IBM i systems run critical operations in banking, manufacturing, and government, so a flaw in their security controls carries broad operational risk.
IBM i, formerly known as AS/400 and iSeries, is a long-established enterprise platform used by thousands of organizations worldwide. It has a reputation for reliability and runs many mission-critical workloads. IBM is a major technology vendor with a diverse product portfolio and a long history of influence on enterprise IT infrastructure.
Technical Information
CVE-2025-36367 is a privilege escalation vulnerability in IBM i SQL services that affects versions 7.2, 7.3, 7.4, 7.5, and 7.6. The cause is an invalid or missing authorization check (CWE-862) in the SQL services component. An authenticated user can exploit it to run SQL procedures or functions with the elevated privileges of another user profile. The attacker needs valid credentials to access the system but does not need elevated privileges to start with.
SQL services do not properly check whether the requesting user has permission to perform certain sensitive operations. An attacker can use that gap to escalate privileges and, in the end, gain root access to the host operating system. Because the flaw is present across multiple major versions, the problem in the authorization logic of IBM i SQL services is a long-standing one. No public code snippets or proof of concept are available for this vulnerability.
Affected Systems and Versions
CVE-2025-36367 affects the following IBM i versions:
- IBM i 7.2
- IBM i 7.3
- IBM i 7.4
- IBM i 7.5
- IBM i 7.6
Any configuration that uses IBM i SQL services on these versions is considered vulnerable until it is patched.
Vendor Security History
IBM i has had several privilege escalation vulnerabilities in recent years, including:
- CVE-2025-33109: Privilege escalation due to invalid database authority check
- CVE-2025-33103: Privilege escalation in TCP/IP Connectivity Utilities
- CVE-2025-2947: Privilege escalation due to incorrect profile swapping in OS command
IBM's Product Security Incident Response Team (PSIRT) manages vulnerability disclosures and patch releases. IBM typically publishes timely advisories and security updates through its support channels.
