What is the CVSS score of CVE-2026-17075?

CVE-2026-17075 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of IBM i are affected by CVE-2026-17075?

IBM i systems running versions 7.3 through 7.6 can be compromised by remote unauthenticated attackers to extract sensitive data through authentication token validation flaws.. A patch is available.

How to fix or mitigate CVE-2026-17075?

Within 24 hours, identify and inventory all IBM i 7.3 through 7.6 systems in your environment and determine which are network-reachable; segregate high-risk systems if network access cannot be immediately restricted. Within 7 days, apply the vendor-released patch to all affected systems, prioritizing those handling sensitive data or customer information; if patching is delayed, implement network segmentation or access controls to limit exposure. Within 30 days, complete patch deployment across your entire IBM i environment and review authentication logs and access records from the period prior to patching to detect any suspicious activity or data extraction.

IBM i CVE-2026-17075

EUVD-2026-58453 HIGH

Improper Authentication (CWE-287)

2026-08-13 ibm

GHSA-pcj8-43hf-pqxw

Authentication Bypass IBM

8.2

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Network-reachable auth token bypass requires no credentials or interaction; C:H reflects sensitive data exposure, I:L reflects limited unauthorized operations, A:N as no availability impact is described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 19, 2026 - 17:02 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 19, 2026 - 16:52 vuln.today

cvss_changed

Severity Changed

Aug 19, 2026 - 16:52 NVD

MEDIUM HIGH

CVSS changed

Aug 19, 2026 - 16:52 NVD

6.5 (MEDIUM) 8.2 (HIGH)

Analysis Generated

Aug 13, 2026 - 21:47 vuln.today

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information and perform unauthorized operations due to improper validation of authentication tokens.

AnalysisAI

Authentication token validation flaws in IBM i 7.3 through 7.6 expose network-reachable systems to remote unauthenticated attackers capable of extracting sensitive information and performing limited unauthorized operations. The CWE-287 root cause (Improper Authentication) combined with a PR:N/AV:N CVSS vector confirms exploitation requires no credentials and no user interaction over the network. No active exploitation has been confirmed (not in CISA KEV), EPSS sits at 0.31% (23rd percentile), and SSVC marks exploitation status as 'none' - signals that collectively moderate urgency despite the 8.2 CVSS score.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's proprietary operating system for IBM Power Systems servers, widely deployed in enterprise environments supporting mission-critical workloads in banking, retail, manufacturing, and government. The vulnerability is rooted in CWE-287 (Improper Authentication): the platform fails to properly validate authentication tokens presented to one or more network-accessible services, allowing crafted or malformed tokens to bypass access controls. The relevant CPE string cpe:2.3:a:ibm:i covers all sub-releases across IBM i 7.3, 7.4, 7.5, and 7.6. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates the vulnerable service is directly reachable over the network with no credential or interaction prerequisite from the attacker's side.

RemediationAI

IBM has released a patch addressing this vulnerability, available through the IBM support portal at https://www.ibm.com/support/pages/node/7283569. Administrators should identify and apply the relevant Program Temporary Fix (PTF) for their specific IBM i release level (7.3, 7.4, 7.5, or 7.6); the exact PTF number is not independently confirmed in available intelligence and must be obtained directly from the IBM advisory. As a compensating control prior to patching, restrict network access to IBM i authentication services using host-based exit point controls or perimeter firewall ACLs to limit reachability to known trusted hosts - note that overly broad restrictions may disrupt legitimate remote access and must be tested carefully. Additionally, enable QAUDJRN (IBM i security audit journal) with *AUTFAIL and *SIGNON object auditing to detect anomalous token-based authentication attempts, which can surface exploitation attempts without blocking service.