What is the CVSS score of CVE-2026-17045?

CVE-2026-17045 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of IBM i are affected by CVE-2026-17045?

IBM i systems running versions 7.3 through 7.6 contain a session management vulnerability (CVE-2026-17045) allowing authenticated, low-privileged users to bypass access controls and access sensitive…. A patch is available.

How to fix or mitigate CVE-2026-17045?

Within 24 hours: audit all IBM i systems to identify instances running versions 7.3-7.6 and document current patch levels. Within 7 days: obtain and apply the vendor-released patch to all affected IBM i instances across development, testing, and production environments. Within 30 days: validate patch deployment across all systems, implement enhanced session monitoring to detect replay attacks or suspicious session activity, and strengthen access controls to restrict unnecessary privileges.

IBM i CVE-2026-17045

EUVD-2026-58388 HIGH

Authentication Bypass by Capture-replay (CWE-294)

2026-08-13 ibm

GHSA-mf64-cp3p-f7ww

Information Disclosure IBM

8.1

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-exploitable session replay flaw requires low-privilege authentication (PR:L); high C and I reflect unauthorized data access and operation execution; no availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:42 vuln.today

CVE Published

Aug 13, 2026 - 19:54 nvd

HIGH 8.1

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management.

AnalysisAI

Improper session management in IBM i 7.3 through 7.6 enables remote authenticated attackers to perform unauthorized operations and access sensitive information without elevated privileges. The vulnerability maps to CWE-294 (Authentication Bypass by Capture-replay), meaning valid but low-privileged credentials are sufficient to exploit weaknesses in how sessions are validated or managed. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS score of 8.1 reflects high confidentiality and integrity impact with low attack complexity.

Technical ContextAI

IBM i is an integrated operating system running on IBM Power Systems hardware, widely deployed in enterprise environments for mission-critical business workloads including ERP, banking, and manufacturing systems. The CWE-294 root cause class - Authentication Bypass by Capture-replay - indicates that the session management mechanism fails to adequately protect session tokens or credentials from being intercepted and reused, allowing an already-authenticated attacker to exceed their authorized scope. The affected CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all subversions of IBM i 7.3, 7.4, 7.5, and 7.6. This class of flaw typically arises from weak session token binding, missing anti-replay protections, or insufficient session context validation.

RemediationAI

Apply the vendor-released patch as documented in the IBM advisory at https://www.ibm.com/support/pages/node/7283569. Exact patched build numbers and PTF identifiers are not specified in available intelligence - consult the advisory directly for the specific cumulative fix package applicable to your IBM i release level (7.3, 7.4, 7.5, or 7.6). As compensating controls prior to patching, restrict network access to IBM i systems using firewall rules to limit exposure to trusted hosts only, reducing the attacker's ability to reach the vulnerable session management layer. Enforce aggressive session timeout policies and audit active sessions for anomalous activity. Require strong, unique credentials for all IBM i user profiles to reduce the viability of credential-compromise scenarios that would enable exploitation.