What is the CVSS score of CVE-2026-17004?

CVE-2026-17004 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by CVE-2026-17004?

IBM i operating systems (versions 7.3-7.6) are vulnerable to remote denial-of-service attacks that can crash or hang affected systems without requiring authentication or user interaction.. A patch is available.

How to fix or mitigate CVE-2026-17004?

Within 24 hours, inventory all IBM i systems in your environment and confirm which versions (7.3-7.6) are deployed and currently in use. Within 7 days, apply the vendor-released patch to all affected IBM i systems through a controlled maintenance window, starting with production systems. By day 30, verify patch deployment across your entire IBM i fleet using configuration management tools and confirm that no systems remain on vulnerable versions.

IBM i CVE-2026-17004

EUVD-2026-58235 HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-08-13 ibm

GHSA-2h68-xjg6-2738

Denial Of Service IBM

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable with no authentication or user interaction required; only availability is impacted with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 19:49 vuln.today

CVE Published

Aug 13, 2026 - 18:53 cve.org

HIGH 7.5

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop.

AnalysisAI

Denial of service in IBM i 7.3 through 7.6 allows remote unauthenticated attackers to crash or hang affected systems by triggering an infinite loop condition (CWE-835) over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and minimal complexity, making automated exploitation straightforward. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's vertically integrated enterprise platform combining operating system, database, middleware, and application runtime - widely deployed in banking, manufacturing, and government. CWE-835 (Loop with Unreachable Exit Condition) describes a code path that enters an iterative construct with no reachable exit, causing a thread or process to spin indefinitely, consuming CPU or memory until the service or system becomes unavailable. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all sub-versions of IBM i across the 7.3-7.6 release lines. The specific network-facing subsystem or protocol component in which the loop occurs is not disclosed in available vendor data.

RemediationAI

IBM has released a patch per vendor advisory; apply the fix documented at https://www.ibm.com/support/pages/node/7283578, selecting the appropriate PTF (Program Temporary Fix) for your IBM i release level (7.3, 7.4, 7.5, or 7.6). No exact patched version number is specified in the available input data - consult the advisory directly to identify the correct PTF identifier for your release. As a compensating control prior to patching, restrict inbound network access to IBM i network-facing services using network ACLs or firewall rules, limiting exposure to trusted hosts only; note this may impact legitimate remote access and application connectivity. The specific vulnerable service or port is not disclosed, so broad perimeter restriction may be necessary as an interim measure.