What is the CVSS score of CVE-2026-17088?

CVE-2026-17088 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-17088?

Yes, a patch is available for CVE-2026-17088. Update the affected software to the latest version immediately.

IBM i CVE-2026-17088

EUVD-2026-58397 MEDIUM

Path Traversal (CWE-22)

2026-08-13 ibm

GHSA-85m4-8wrc-xhw7

Path Traversal IBM

4.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible with low complexity and low privilege required; impact limited to partial confidentiality, consistent with read-only path traversal disclosure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 21:09 vuln.today

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.

AnalysisAI

Path traversal in IBM i 7.3, 7.4, 7.5, and 7.6 allows a remote authenticated attacker to read sensitive files outside their permitted directory boundaries, resulting in unauthorized information disclosure. The vulnerability carries a CVSS 3.1 base score of 4.3 (Medium) and is limited strictly to confidentiality impact - integrity and availability are unaffected. A vendor-supplied patch is available, and no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

IBM i (formerly OS/400 and i5/OS) is IBM's tightly integrated operating system running on IBM Power Systems hardware, widely deployed in enterprise, financial, and government environments for mission-critical transactional workloads. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the system fails to sufficiently canonicalize or sanitize user-supplied path components, allowing an attacker to inject directory traversal sequences (e.g., '../') to escape the intended file access scope and read arbitrary files. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) spans all sub-releases within IBM i 7.3, 7.4, 7.5, and 7.6. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms this is a network-accessible, low-complexity flaw requiring only low-privilege credentials, scoped to the vulnerable system with partial confidentiality impact.

RemediationAI

Apply the vendor-supplied patch as documented in the IBM support advisory at https://www.ibm.com/support/pages/node/7283569. IBM i patches are distributed as PTFs (Program Temporary Fixes) specific to each OS release level (7.3, 7.4, 7.5, 7.6); administrators should retrieve and apply the appropriate PTF for their installed version. An exact patched version number was not independently specified in the source data beyond 'patch available from vendor' - consult the advisory for the precise PTF identifier. As a compensating control prior to patching, restrict network access to IBM i services to only trusted and necessary hosts, and audit user account provisioning to ensure the principle of least privilege is enforced, reducing the population of accounts that could leverage this traversal. Note that restricting network access may affect legitimate remote operations and should be evaluated against operational requirements.