What is the CVSS score of CVE-2026-17101?

CVE-2026-17101 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by CVE-2026-17101?

IBM i integrated systems (versions 7.3-7.6) face a critical authentication bypass vulnerability (CVSS 9.6) enabling remote code execution and sensitive data access when users interact with…. A patch is available.

How to fix or mitigate CVE-2026-17101?

Within 24 hours, identify and document all IBM i systems running versions 7.3, 7.4, 7.5, or 7.6. Within 7 days, apply IBM's published patch (available via support node 7283292) to test systems and validate compatibility. Within 30 days, roll out the patch to production IBM i environments and confirm successful deployment across all affected instances.

IBM i CVE-2026-17101

EUVD-2026-58399 CRITICAL

Improper Authentication (CWE-287)

2026-08-13 ibm

GHSA-94qj-cpvx-mwwc

Authentication Bypass RCE IBM

9.6

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network, low-complexity, unauthenticated auth bypass needing user interaction (UI:R) with full code-exec/data impact; scope set U as the generic description gives no evidence of a cross-boundary change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 19, 2026 - 17:01 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 19, 2026 - 16:52 vuln.today

cvss_changed

Severity Changed

Aug 19, 2026 - 16:52 NVD

HIGH CRITICAL

CVSS changed

Aug 19, 2026 - 16:52 NVD

8.3 (HIGH) 9.6 (CRITICAL)

Analysis Generated

Aug 13, 2026 - 21:07 vuln.today

CVE Published

Aug 13, 2026 - 20:27 cve.org

HIGH 8.3

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.

AnalysisAI

Improper authentication in IBM i (IBM's integrated midrange operating system, formerly OS/400) versions 7.3, 7.4, 7.5 and 7.6 allows a remote attacker to bypass authentication controls to execute arbitrary code or read sensitive data, provided a legitimate user is induced to interact (UI:R). IBM has published a fix (support node 7283292) and rates it 9.6 critical; there is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS score of 0.41% (34th percentile) indicating no observed mass exploitation yet.

Technical ContextAI

IBM i is the object-based operating system running on IBM Power Systems (historically AS/400 / iSeries), widely used for ERP, banking and manufacturing workloads and reachable over network services such as host servers, TCP/IP daemons and web/application interfaces. The root cause is CWE-287 (Improper Authentication), meaning an identity- or credential-verification step can be bypassed or spoofed, allowing an actor to be treated as an authenticated principal without valid credentials. The single generic CPE (cpe:2.3:a:ibm:i:*) does not identify which specific IBM i subsystem or licensed program contains the flaw, so the exact affected component is not disclosed in the available data.

RemediationAI

Apply the IBM-supplied fix documented at https://www.ibm.com/support/pages/node/7283292 (patch available per vendor advisory) across all affected releases 7.3, 7.4, 7.5 and 7.6 by installing the corresponding IBM i PTFs/Group PTF levels referenced in that advisory; exact fix version numbers are not provided in the input, so pull them directly from the IBM support page. Because exploitation requires user interaction over the network, until PTFs are applied reduce exposure by restricting network reachability of IBM i host servers and TCP/IP services to trusted management networks (firewall/allow-list to the affected daemons), disabling unused network servers, and enforcing least privilege - noting the trade-off that tightening host-server access may disrupt client applications (e.g., ODBC/JDBC, Navigator, host-server-dependent tooling). Given UI:R, also counsel operators against interacting with untrusted requests/content directed at the system. Do not treat these as substitutes for the PTFs.