What is the CVSS score of CVE-2026-1376?

CVE-2026-1376 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM are affected by CVE-2026-1376?

IBM i 7.6 systems are vulnerable to denial of service attacks through malicious authentication attempts, potentially disrupting critical business operations.. A patch is available.

How to fix or mitigate CVE-2026-1376?

Within 24 hours: Identify and inventory all IBM i 7.6 systems in production and development environments. Within 7 days: Test the available patch in a non-production environment and develop a deployment plan. Within 30 days: Deploy the patch across all affected systems following your change management process, prioritizing critical business systems.

IBM CVE-2026-1376

EUVD-2026-12645 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-03-17 ibm

IBM Denial Of Service

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 17, 2026 - 22:08 euvd

EUVD-2026-12645

Analysis Generated

Mar 17, 2026 - 22:08 vuln.today

Patch released

Mar 17, 2026 - 22:08 nvd

Patch available

CVE Published

Mar 17, 2026 - 21:53 nvd

HIGH 7.5

DescriptionCVE.org

IBM i 7.6 could allow a remote attacker to cause a denial of service using failed authentication connections due to improper allocation of resources.

AnalysisAI

A resource exhaustion vulnerability in IBM i 7.6 allows unauthenticated remote attackers to cause a denial of service by overwhelming the system with failed authentication attempts. The vulnerability stems from improper resource allocation during authentication processing, enabling attackers to consume system resources without valid credentials. While no active exploitation or proof-of-concept has been reported, the high CVSS score of 7.5 reflects the ease of remote exploitation without authentication.

Technical ContextAI

IBM i (formerly known as AS/400 or iSeries) is an enterprise operating system running on IBM Power Systems hardware. The vulnerability affects IBM i version 7.6 as identified by the CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*, though the wildcard pattern suggests multiple sub-versions may be impacted. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), indicating the system fails to properly limit resources allocated to handle authentication requests, allowing an attacker to exhaust system resources through repeated failed login attempts.

RemediationAI

Apply the patch available from IBM as documented in their security advisory at https://www.ibm.com/support/pages/node/7266422. Until patching is complete, consider implementing rate limiting on authentication attempts at the network level, deploying intrusion detection systems to monitor for authentication floods, and restricting network access to IBM i systems to trusted IP ranges only. Monitor system resources and authentication logs for signs of exploitation attempts targeting this vulnerability.