What is the CVSS score of CVE-2026-17218?

CVE-2026-17218 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of IBM i are affected by CVE-2026-17218?

IBM i operating system versions 7.3 through 7.6 contain a critical remote code execution vulnerability that requires no authentication or user interaction to exploit.. A patch is available.

How to fix or mitigate CVE-2026-17218?

Within 24 hours, conduct a complete inventory of IBM i systems across your environment and identify all instances running versions 7.3, 7.4, 7.5, or 7.6; assess their network exposure and prioritize externally-facing systems. Within 7 days, obtain the vendor-released patch from IBM and validate it against your existing applications in isolated test environments to confirm compatibility. Within 30 days, deploy the patched versions to all affected IBM i systems, beginning with those handling sensitive data or supporting critical business operations.

IBM i CVE-2026-17218

EUVD-2026-57384 CRITICAL

Out-of-bounds Write (CWE-787)

2026-08-12 ibm

GHSA-vp3r-vq2j-x4g2

RCE Buffer Overflow Memory Corruption IBM

9.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor describes unauthenticated remote code execution via out-of-bounds write with no user interaction, yielding full confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 18:39 vuln.today

CVE Published

Aug 12, 2026 - 17:35 nvd

CRITICAL 9.8

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

AnalysisAI

Remote code execution in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to run arbitrary code via an out-of-bounds write (CWE-787) memory-corruption flaw. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), indicating unauthenticated network exploitation with no user interaction against affected releases. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so the 9.8 rating reflects potential impact rather than confirmed exploitation.

Technical ContextAI

IBM i is IBM's integrated midrange operating environment running on Power Systems hardware, widely used for transactional business workloads in banking, insurance, manufacturing, and retail. The CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* confirms the IBM i platform itself is the affected product across releases 7.3 through 7.6. The root cause is CWE-787 (Out-of-bounds Write): a component fails to validate the bounds of a buffer before writing, letting attacker-controlled data overwrite adjacent memory. On a network-facing service this can corrupt control data or program state and be leveraged into arbitrary code execution, which aligns with the vendor's RCE and memory-corruption tags. The specific vulnerable service or protocol handler is not disclosed in the available data.

RemediationAI

Patch available per vendor advisory: apply the fix IBM published at https://www.ibm.com/support/pages/node/7283277, following that page for the exact PTF/PTF group for each of releases 7.3, 7.4, 7.5, and 7.6 (the specific patched level is not enumerated in the supplied data and must be taken from the advisory). Because this is an unauthenticated network RCE, prioritize the patch on any IBM i partition reachable from untrusted networks. Until PTFs are applied, reduce exposure with compensating network controls: restrict inbound access to the affected IBM i host to trusted management networks via firewall/ACLs, and disable or firewall-off any non-essential network services on the partition to shrink the attack surface - noting the trade-off that blocking ports may disrupt legitimate remote application, printing, or database connectivity, so validate service dependencies before restricting them.