What is the CVSS score of CVE-2026-17199?

CVE-2026-17199 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by CVE-2026-17199?

IBM i platforms 7.3 through 7.6 are vulnerable to an unauthenticated, network-accessible denial of service attack that can exhaust system resources and render these critical systems unavailable to…. A patch is available.

How to fix or mitigate CVE-2026-17199?

Within 24 hours, identify all IBM i systems in production running versions 7.3 through 7.6 and assess their business criticality; communicate this finding to system owners and review emergency change control procedures for expedited patching. Within 7 days, contact IBM for the specific patch version applicable to your IBM i release level and conduct compatibility testing in a staging environment against your critical workloads. Within 30 days, deploy the vendor patch across all affected production IBM i 7.3 through 7.6 systems and verify successful remediation by confirming updated version levels post-deployment.

IBM i CVE-2026-17199

EUVD-2026-58234 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-13 ibm

GHSA-cv87-7vg4-8whg

Denial Of Service IBM

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-accessible unauthenticated DoS with no confidentiality or integrity impact; AC:L because description implies straightforward resource exhaustion without complex preconditions.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 19:48 vuln.today

CVE Published

Aug 13, 2026 - 18:52 cve.org

HIGH 7.5

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to unbounded resource allocation.

AnalysisAI

Denial of service in IBM i 7.3 through 7.6 allows remote unauthenticated attackers to exhaust system resources through unbounded resource allocation, rendering the platform unavailable to legitimate users. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction, with low attack complexity over the network. No public exploit code and no CISA KEV entry have been identified at the time of analysis; a vendor patch is available.

Technical ContextAI

IBM i (formerly OS/400 and i5/OS) is an integrated operating system designed exclusively for IBM Power Systems servers, commonly deployed in enterprise and legacy environments for transactional workloads. The vulnerability is rooted in CWE-770 (Allocation of Resources Without Limits or Throttling), meaning a specific network-accessible component fails to enforce caps on resource consumption - such as memory, threads, file handles, or connections - when processing attacker-controlled input. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all subversions of IBM i 7.3, 7.4, 7.5, and 7.6. The IBM advisory at https://www.ibm.com/support/pages/node/7283578 is the authoritative source for the specific affected subsystem, which is not identified in the NVD description.

RemediationAI

Apply the vendor-released patch per the IBM advisory at https://www.ibm.com/support/pages/node/7283578. The exact fixed version number is not specified in the available intelligence data; administrators should reference that advisory directly to identify the correct PTF (Program Temporary Fix) or Technology Refresh level required for each IBM i release (7.3, 7.4, 7.5, 7.6). As a compensating control where patching is not immediately possible, restrict network access to the affected IBM i service at the firewall or network perimeter - this directly counters the AV:N attack vector. Additionally, implement connection-rate limiting or resource throttling at the network layer for the relevant service ports. Note that network-level controls are a workaround only and do not eliminate the underlying flaw.