EUVD-2026-12645Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend repeated failed authentication requests
-
ExploitExhaust server connection resources
-
ImpactTrigger denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker sending repeated failed authentication connections to IBM i 7.6. No special configuration required. Default installations are vulnerable to resource exhaustion denial of service. |
| Impact | The CVSS 3.1 score of 7.5 (High) reflects a network-exploitable vulnerability requiring no authentication (AV:N/AC:L/PR:N/UI:N) that can cause high availability impact (A:H). However, the real-world risk appears moderate as there is no evidence of active exploitation (not listed in CISA KEV), no known proof-of-concept code, and no EPSS score indicating exploitation probability. The attack is automatable given the low complexity and network vector, but the impact is limited to availability with no confidentiality or integrity compromise. This represents a typical denial-of-service vulnerability that should be prioritized for patching but is not an emergency unless the affected IBM i systems are internet-facing or critical to business operations. |
| Exploit ScenarioDerived | An attacker could remotely target an IBM i 7.6 system by sending a flood of authentication requests with invalid credentials over the network. Since the system improperly allocates resources for each failed attempt without adequate limits, the attacker can exhaust system resources and prevent legitimate users from accessing the system, achieving a denial of service without needing valid credentials or special tools. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A resource exhaustion vulnerability in IBM i 7.6 allows unauthenticated remote attackers to cause a denial of service by overwhelming the system with failed authentication attempts. The vulnerability stems from improper resource allocation during authentication processing, enabling attackers to consume system resources without valid credentials. While no active exploitation or proof-of-concept has been reported, the high CVSS score of 7.5 reflects the ease of remote exploitation without authentication.
RemediationAI
Apply the patch available from IBM as documented in their security advisory at https://www.ibm.com/support/pages/node/7266422. Until patching is complete, consider implementing rate limiting on authentication attempts at the network level, deploying intrusion detection systems to monitor for authentication floods, and restricting network access to IBM i systems to trusted IP ranges only. Monitor system resources and authentication logs for signs of exploitation attempts targeting this vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM i (formerly known as AS/400 or iSeries) is an enterprise operating system running on IBM Power Systems hardware. The vulnerability affects IBM i version 7.6 as identified by the CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*, though the wildcard pattern suggests multiple sub-versions may be impacted. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), indicating the system fails to properly limit resources allocated to handle authentication requests, allowing an attacker to exhaust system resources through repeated failed login attempts.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
IBM i 7.6 could allow a remote attacker to cause a denial of service using failed authentication connections due to improper allocation of resources.
Executive ViewAI
IBM i 7.6 systems are vulnerable to denial of service attacks through malicious authentication attempts, potentially disrupting critical business operations. Organizations running this platform should prioritize patching to prevent service interruptions and maintain operational continuity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GitHub PoC
Exploit-DB