What is the CVSS score of CVE-2026-17094?

CVE-2026-17094 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of IBM i are affected by CVE-2026-17094?

IBM i systems in multi-tenant or shared environments are vulnerable to file access and manipulation attacks by any authenticated user with low-privilege credentials, creating data breach and…. A patch is available.

How to fix or mitigate CVE-2026-17094?

Within 24 hours, inventory all IBM i systems running versions 7.3 through 7.6 and identify which support multi-tenant or shared-access use cases. Within 7 days, obtain the patched IBM i release from IBM's support portal and conduct testing in a non-production environment that matches your production configuration. Within 30 days, deploy the patched version to all affected IBM i systems, prioritizing multi-tenant deployments, and validate successful patch installation.

IBM i CVE-2026-17094

EUVD-2026-57353 HIGH

Path Traversal (CWE-22)

2026-08-12 ibm

GHSA-v633-rhmc-84gm

Path Traversal IBM

7.1

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network-reachable path traversal requiring only low-privilege auth; high confidentiality, limited integrity write impact, no availability impact confirmed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 14:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 14:22 vuln.today

cvss_changed

Severity Changed

Aug 17, 2026 - 14:22 NVD

MEDIUM HIGH

CVSS changed

Aug 17, 2026 - 14:22 NVD

4.3 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Aug 12, 2026 - 17:42 vuln.today

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerability.

AnalysisAI

Path traversal in IBM i 7.3 through 7.6 allows remote authenticated attackers to read sensitive files and write or manipulate files outside intended directory boundaries. The vulnerability is reachable over the network with only low-privilege credentials, making it accessible to a broad set of authenticated users in multi-tenant or shared IBM i environments. No active exploitation or public proof-of-concept has been identified at time of analysis, and IBM has released a patch via their support portal.

Technical ContextAI

IBM i (formerly AS/400, iSeries) is IBM's integrated operating system for Power Systems hardware. The vulnerability is classified under CWE-22 (Path Traversal), a root cause where user-controlled input containing sequences such as '../' is not properly sanitized before being used to construct file system paths. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* confirms that the affected component is IBM's i platform application layer itself, spanning all minor releases within the 7.3-7.6 major version stream. The CVSS vector AV:N/AC:L/PR:L reflects that the flaw is exploitable remotely over the network, under low access complexity, with only low-privilege authentication-consistent with a server-side path traversal in a networked service that authenticated users can reach.

RemediationAI

IBM has released a patch available via the IBM support portal at https://www.ibm.com/support/pages/node/7283292; administrators should apply the relevant PTFs for their IBM i release (7.3, 7.4, 7.5, or 7.6) as identified in the advisory. The exact PTF numbers and fix version identifiers should be obtained directly from that advisory, as no specific fix version string was included in the available intelligence data. As a compensating control prior to patching, administrators may restrict network access to the affected IBM i services to trusted IP ranges or authenticated VPN users only, reducing exposure without disabling the service entirely-though this does not eliminate the vulnerability for users who retain legitimate access. Audit file system access logs for unexpected directory traversal patterns (sequences of '../') in the interim.