What is the CVSS score of CVE-2026-17071?

CVE-2026-17071 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-17071?

Yes, a patch is available for CVE-2026-17071. Update the affected software to the latest version immediately.

IBM i CVE-2026-17071

EUVD-2026-58392 LOW

Path Traversal (CWE-22)

2026-08-13 ibm

GHSA-gp26-5xf9-qgh8

Path Traversal IBM

2.7

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

2.7 LOW

Network-reachable path traversal requires high-privilege authentication; only limited file integrity impact applies, with no confidentiality or availability consequences.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 21:11 vuln.today

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform file manipulation due to path traversal.

AnalysisAI

Path traversal in IBM i 7.3 through 7.6 enables remote attackers holding high-privilege credentials to manipulate files outside intended directory boundaries. The CVSS score of 2.7 (Low) accurately reflects the constrained impact - exploitation is limited to authenticated users with high privileges (PR:H), and the resulting damage is restricted to limited file integrity modification with no confidentiality or availability consequences. No public exploit code has been identified at time of analysis, and IBM has released a vendor patch.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's integrated operating system for Power Systems hardware, widely used in financial services, manufacturing, and retail for legacy enterprise workloads. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) identifies the root cause: insufficient sanitization of file path inputs, allowing traversal sequences (e.g., '../') to escape the intended directory context and reference arbitrary file system locations. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all sub-versions within the affected major releases 7.3, 7.4, 7.5, and 7.6. The CVSS vector (AV:N/AC:L/PR:H) confirms the vulnerability is reachable over the network by a privileged authenticated session, without requiring any special environmental configuration beyond having high-privilege access.

RemediationAI

IBM has released a patch addressing CVE-2026-17071, available through the vendor advisory at https://www.ibm.com/support/pages/node/7283569. Administrators should consult that advisory to identify and apply the appropriate PTF for their specific IBM i release (7.3, 7.4, 7.5, or 7.6). The exact patched PTF identifiers are not specified in currently available data and must be confirmed via the IBM support page. As a compensating control pending patch application, restrict high-privilege account usage on IBM i to only the accounts and personnel that strictly require it, and enable auditing of file system operations (QAUDJRN object auditing) to detect anomalous path-based file access by privileged users. Note that restricting file operation commands via IBM i object authority may partially limit exploitability but does not eliminate the underlying path traversal weakness.