What is the CVSS score of CVE-2026-17206?

CVE-2026-17206 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by CVE-2026-17206?

IBM i systems running versions 7.3-7.6 are vulnerable to remote code execution attacks that could grant attackers complete control over business-critical systems and data access without…. A patch is available.

How to fix or mitigate CVE-2026-17206?

Within 24 hours, inventory all IBM i systems across your infrastructure to identify those running versions 7.3-7.6. Within 7 days, obtain the patch from IBM (available per vendor advisory), validate it in a non-production environment, and begin deployment prioritizing critical systems. Within 30 days, complete patching of all affected production systems and verify successful remediation through vulnerability scanning.

IBM i CVE-2026-17206

EUVD-2026-58237 CRITICAL

Out-of-bounds Write (CWE-787)

2026-08-13 ibm

GHSA-433h-8f97-gmmv

RCE Buffer Overflow Memory Corruption IBM

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor-described remote unauthenticated buffer-overflow RCE with no user interaction gives AV:N/AC:L/PR:N/UI:N and full C/I/A impact; scope unchanged as code runs within the OS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 15:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 15:37 vuln.today

cvss_changed

Severity Changed

Aug 17, 2026 - 15:37 NVD

HIGH CRITICAL

CVSS changed

Aug 17, 2026 - 15:37 NVD

8.1 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Aug 13, 2026 - 19:50 vuln.today

CVE Published

Aug 13, 2026 - 18:55 cve.org

HIGH 8.1

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

AnalysisAI

Remote code execution in IBM i (formerly OS/400) releases 7.3 through 7.6 stems from a buffer overflow (out-of-bounds write) that a remote, unauthenticated attacker can trigger to run arbitrary code on the host. IBM has published a fix, and while the CVSS base score is 9.8, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at only 0.37% (30th percentile). CISA's SSVC framing rates exploitation as none and the vulnerability as not automatable, tempering the raw-score urgency.

Technical ContextAI

IBM i is IBM's integrated midrange operating platform (the AS/400 / iSeries lineage) running on Power hardware, widely used for transactional business workloads. The flaw is classified as CWE-787 (Out-of-bounds Write): the affected component writes past the bounds of an allocated buffer, corrupting adjacent memory. When attacker-controlled data drives that overflow, it can overwrite control data or code pointers and redirect execution, which is the mechanism behind the reported arbitrary-code-execution impact. The CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* identifies the IBM i product itself as affected, but neither the description nor the CPE narrows the vulnerability to a specific service, port, or subsystem within the OS.

RemediationAI

Patch available per vendor advisory: apply the fix IBM provides at https://www.ibm.com/support/pages/node/7283578 for your specific IBM i release (7.3, 7.4, 7.5, or 7.6); the exact PTF/fix level is not disclosed in the input data and should be read directly from that IBM support page. Because the vulnerable service is not named in the advisory, effective compensating controls until patching is complete include restricting network reachability of the IBM i partition - place it behind a firewall and limit inbound access to known-good management and application hosts, and disable or block any IBM i network services (for example unused TCP servers under the Host Servers / TCP/IP configuration) that are not required, accepting that this may interrupt client/server or remote-management connectivity for legitimate users. Given SSVC rates exploitation as none, prioritized patching plus network segmentation is a reasonable interim posture rather than emergency isolation.