What is the CVSS score of CVE-2026-17078?

CVE-2026-17078 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-17078?

Yes, a patch is available for CVE-2026-17078. Update the affected software to the latest version immediately.

IBM i CVE-2026-17078

EUVD-2026-58396 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-08-13 ibm

GHSA-f7mg-6655-mmp4

Denial Of Service IBM

5.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated DoS with no complexity barrier; only partial availability impact aligns with resource exhaustion degradation rather than full crash.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 21:09 vuln.today

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to resource exhaustion.

AnalysisAI

Denial of service via uncontrolled resource exhaustion in IBM i versions 7.3 through 7.6 exposes organizations to remote, unauthenticated availability disruption. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity network exploitation with no authentication barrier, enabling any network-reachable attacker to degrade or halt platform availability. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via advisory node 7283571.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's vertically integrated operating system platform combining OS, database, middleware, and runtime into a single stack, widely deployed for mission-critical ERP, financial, and manufacturing workloads. The affected versions - 7.3, 7.4, 7.5, and 7.6 - are reflected in CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*, indicating the vulnerability spans the currently supported release family. The root cause is CWE-400 (Uncontrolled Resource Consumption), a class of flaw where the platform fails to enforce limits on a consumable resource such as memory, threads, file descriptors, or network connections, allowing a remote actor to exhaust available capacity. The specific service, port, or protocol acting as the attack surface is not disclosed in available data.

RemediationAI

Apply the vendor-released PTF (Program Temporary Fix) for the applicable IBM i release (7.3, 7.4, 7.5, or 7.6) as detailed in IBM support advisory at https://www.ibm.com/support/pages/node/7283571. An exact replacement build or PTF number is not independently confirmed in available intelligence beyond the advisory reference, so administrators should consult the IBM support page directly for their release-specific fix. If immediate patching is not feasible, network-level compensating controls should be applied: restrict inbound access to IBM i service ports at the perimeter firewall to trusted IP ranges only (note this may impact remote access scenarios), and consider enabling IBM i connection throttling or TCP connection limits to reduce the impact of sustained resource flooding. These mitigations reduce attack surface but do not eliminate the underlying vulnerability.