CVE-2026-17057
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
IBM i versions 7.6, 7.5, 7.4, and 7.3 lack authentication for critical functions, allowing a remote attacker to cause a denial of service and affect data integrity.
Risk Assessment
Missing authentication enables unauthorized data modifications and disruptions, potentially leading to serious security incidents.
Recommendation
Implement authentication for all critical functions and apply IBM fixes.
Other vulnerabilities in IBM i
See all- CVE-2026-17083Critical
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.
- CVE-2026-17276Critical
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority threads.
- CVE-2026-17218Critical
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
- CVE-2026-16860Critical
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.
- CVE-2026-18869Medium
IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation of FTP PORT and EPRT commands.
- CVE-2026-17262Medium
IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to improper validation of FTP authentication commands.
- CVE-2026-19280Medium
IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminate their own process.
- CVE-2026-19086Low
IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a buffer overflow in a PASE process that can lead to denial of service. An authenticated attacker could leverage this to terminate their own process.
- CVE-2026-18069Medium
IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use (TOCTOU) race condition.
- CVE-2026-18251Medium
IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin.
Original NVD description (English source)
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and affect data integrity due to missing authentication for critical functions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS