CVE-2026-17207
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
IBM i versions 7.6, 7.5, 7.4, and 7.3 have a buffer overflow vulnerability that a remote attacker could exploit to cause a denial of service and compromise integrity.
Risk Assessment
The attack could lead to data corruption and system unavailability, posing a serious threat to information integrity.
Recommendation
Urgently install IBM fixes and monitor the system for unusual network traffic.
Other vulnerabilities in IBM i
See all- CVE-2026-17083Critical
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.
- CVE-2026-17276Critical
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority threads.
- CVE-2026-17218Critical
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
- CVE-2026-16860Critical
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.
- CVE-2026-18869Medium
IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation of FTP PORT and EPRT commands.
- CVE-2026-17262Medium
IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to improper validation of FTP authentication commands.
- CVE-2026-19280Medium
IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminate their own process.
- CVE-2026-19086Low
IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a buffer overflow in a PASE process that can lead to denial of service. An authenticated attacker could leverage this to terminate their own process.
- CVE-2026-18069Medium
IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use (TOCTOU) race condition.
- CVE-2026-18251Medium
IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin.
Original NVD description (English source)
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and compromise integrity due to a buffer overflow.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS