What is the CVSS score of CVE-2026-17099?

CVE-2026-17099 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of IBM i are affected by CVE-2026-17099?

IBM i platforms (versions 7.3-7.6) contain an authentication bypass vulnerability allowing remote attackers to access sensitive systems without credentials.. A patch is available.

How to fix or mitigate CVE-2026-17099?

Within 24 hours: inventory all IBM i systems running versions 7.3-7.6 and assess network exposure; verify current patch status via IBM support portal. Within 7 days: apply the IBM-released patch to all identified systems, prioritizing production environments, and perform post-patch authentication testing. Within 30 days: conduct access logs review for unauthorized remote connections during the vulnerability window and complete deployment verification across all instances.

IBM i CVE-2026-17099

EUVD-2026-58398 HIGH

Improper Authentication (CWE-287)

2026-08-13 ibm

GHSA-rmq7-27m8-jrhx

Authentication Bypass IBM

7.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Network-reachable auth bypass with no credentials or interaction required; all three impacts low, consistent with limited post-bypass capability and vendor CVSS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 21:07 vuln.today

CVE Published

Aug 13, 2026 - 20:26 cve.org

HIGH 7.3

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication.

AnalysisAI

Improper authentication in IBM i 7.3 through 7.6 enables remote unauthenticated attackers to bypass authentication controls over the network, yielding access to sensitive information with additional low-level integrity and availability impact per the CVSS vector. The vulnerability is classified under CWE-287 (Improper Authentication) and tagged as an authentication bypass, indicating the platform's authentication mechanism can be circumvented without credentials. No public exploit code has been identified at time of analysis, and IBM has released a patch via their support portal.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's proprietary integrated operating system for IBM Power Systems hardware, widely deployed in enterprise environments for transaction processing, ERP, and database workloads. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) covers all sub-versions within the declared affected releases: 7.3, 7.4, 7.5, and 7.6. CWE-287 (Improper Authentication) indicates that the implementation fails to correctly verify that a request or claim about the identity of an actor is valid - this can manifest as missing authentication on certain service endpoints, flawed token validation, or bypass-able credential checks in specific protocol handlers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is reachable over the network with no complexity barrier and requires neither credentials nor user interaction, which is consistent with a protocol-level or service-level authentication bypass.

RemediationAI

IBM has released a patch addressing this vulnerability; apply it immediately by consulting the IBM support advisory at https://www.ibm.com/support/pages/node/7283292 for PTF (Program Temporary Fix) identifiers specific to each affected IBM i release (7.3, 7.4, 7.5, 7.6). An exact patched version number or PTF ID is not independently confirmed from the available data - retrieve the specific fix identifiers directly from the advisory. As a compensating control pending patch application, restrict network access to IBM i services involved in the authentication bypass using firewall rules or IBM i's network attribute controls (CHGNETA) to limit exposure to trusted internal segments only; note this does not eliminate risk for internally-sourced attacks. Disabling or restricting access to the specific service or protocol handler affected would be the most targeted workaround, but the precise service is not identified in available data - contact IBM support for service-level isolation guidance.