What is the CVSS score of CVE-2026-17109?

CVE-2026-17109 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-17109?

Yes, a patch is available for CVE-2026-17109. Update the affected software to the latest version immediately.

IBM i CVE-2026-17109

EUVD-2026-57374 MEDIUM

Improper Input Validation (CWE-20)

2026-08-12 ibm

GHSA-jh8h-36r8-6cqh

IBM Code Injection

4.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.4 MEDIUM

Network-reachable with low complexity; PR:L reflects mandatory authentication; I:L added because parameter injection that alters command behavior plausibly affects system state integrity.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 18:47 vuln.today

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a command due to parameter injection.

AnalysisAI

Parameter injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to append unexpected parameters to system commands, with a vendor-confirmed availability impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) places this at Medium severity, requiring only valid credentials and network access with no user interaction. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.

Technical ContextAI

IBM i (formerly OS/400 and i5/OS) is IBM's proprietary integrated operating system for IBM Power Systems hardware, widely used in financial services, manufacturing, and retail sectors. The root cause is CWE-20 (Improper Input Validation): the system fails to adequately sanitize or delimit user-controlled input before constructing or dispatching commands, allowing an attacker to append or inject additional parameters that alter the intended command semantics. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* spans all sub-releases of IBM i 7.3, 7.4, 7.5, and 7.6, indicating the flaw is present across both current and extended-support release lines. The specific command interface or subsystem susceptible to injection is not identified in the available data.

RemediationAI

IBM has released a patch for this vulnerability; administrators should apply the relevant PTF for their IBM i release (7.3, 7.4, 7.5, or 7.6) by consulting the IBM advisory at https://www.ibm.com/support/pages/node/7283289. An exact patched version string is not independently confirmable from the provided data - the advisory must be used to identify correct PTF numbers per release level. As a compensating control prior to patching, restrict access to IBM i command-processing interfaces (such as CL command entry points or API surfaces exposed to remote sessions) to the minimum set of trusted accounts, and audit current user privilege grants on the affected systems. Note that access restriction does not eliminate the vulnerability but reduces the exploitable population to the smallest feasible set.