What is the CVSS score of CVE-2026-17197?

CVE-2026-17197 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM i are affected by CVE-2026-17197?

IBM i operating systems (versions 7.3-7.6) are exposed to remote unauthenticated authentication bypass (CVE-2026-17197), allowing attackers to impersonate users and gain full system access without…. A patch is available.

How to fix or mitigate CVE-2026-17197?

Within 24 hours, identify all IBM i systems running versions 7.3, 7.4, 7.5, or 7.6 and classify them by criticality (transaction processing, customer data, production vs. test). Within 7 days, obtain the vendor-released patch from IBM and deploy it to non-critical systems first; validate stability and performance before rolling out to production environments. Within 30 days, complete patching of all affected production systems and enable audit logging for authentication and resource access changes to detect any exploitation that may have occurred before patching.

IBM i CVE-2026-17197

EUVD-2026-58230 CRITICAL

Improper Authentication (CWE-287)

2026-08-13 ibm

GHSA-wwrx-44p3-rrv2

Authentication Bypass IBM

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Improper validation of a client-asserted identity is remotely reachable, needs no credentials or user interaction, and yields impersonation with full data access, so PR:N/AC:L and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 15:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 15:07 vuln.today

cvss_changed

Severity Changed

Aug 17, 2026 - 15:07 NVD

HIGH CRITICAL

CVSS changed

Aug 17, 2026 - 15:07 NVD

8.1 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Aug 13, 2026 - 19:23 vuln.today

CVE Published

Aug 13, 2026 - 18:49 nvd

HIGH 8.1

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity.

AnalysisAI

Authentication bypass in IBM i (the operating system for IBM Power/AS-400 midrange systems) versions 7.3, 7.4, 7.5, and 7.6 allows remote attackers to circumvent security restrictions because the system improperly validates a client-asserted identity (CWE-287). Because a caller's claimed identity is trusted without adequate verification, an attacker can impersonate another principal and gain unauthorized access to protected resources with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.34%, 27th percentile), but the CVSS 9.8 rating and network-reachable, unauthenticated vector make this a high-priority patch.

Technical ContextAI

IBM i is IBM's integrated operating environment for Power Systems (historically AS/400 and iSeries), widely used to run business-critical ERP, database (Db2 for i), and transaction workloads. The CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* confirms the affected component is the IBM i platform itself rather than a bolt-on application. The root cause is classified as CWE-287 (Improper Authentication): the system relies on an identity that the client asserts about itself and fails to independently validate or bind that assertion to a verified credential. In such designs - common in network services, single-sign-on token exchange, or inter-process/host trust relationships - an attacker who can control the asserted identity value can present themselves as a more privileged principal, defeating the intended authentication boundary.

RemediationAI

Apply the IBM-provided fix (Patch available per vendor advisory) as documented at https://www.ibm.com/support/pages/node/7283578; IBM i fixes are typically delivered as PTFs/Group PTFs for the specific release (7.3, 7.4, 7.5, or 7.6), so identify your installed release and apply the corresponding PTF rather than a single cross-version build. The advisory did not publish a single exact fix build in the provided data, so consult the IBM node above for the precise PTF identifiers. Until PTFs are applied, reduce exposure by restricting network reachability of IBM i services to trusted management networks (firewall/segmentation limiting which hosts can reach the affected service ports), disabling or limiting any inter-host or single-sign-on trust relationships that rely on client-asserted identity, and increasing authentication/audit logging (QAUDJRN) to detect impersonation attempts - with the trade-off that network restrictions may disrupt legitimate integrations and stricter trust settings can break automated host-to-host workflows.