What is the CVSS score of CVE-2026-17229?

CVE-2026-17229 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by CVE-2026-17229?

CVE-2026-17229 exposes IBM i systems (versions 7.3-7.6) to unauthenticated remote denial of service attacks that can disable critical business operations without requiring credentials or user…. A patch is available.

How to fix or mitigate CVE-2026-17229?

Within 24 hours, inventory all IBM i 7.3-7.6 instances and assess external network exposure; immediately initiate patch testing in non-production environments. Within 7 days, deploy patches to production systems in phases, prioritizing customer-facing and business-critical systems; implement network-layer rate-limiting or access controls as interim protection if immediate patching is constrained. Complete patch rollout across the entire IBM i estate within 30 days.

IBM i CVE-2026-17229

EUVD-2026-58233 HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-08-13 ibm

GHSA-8w47-mh2r-9w5q

Denial Of Service IBM

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable infinite loop with no authentication, interaction, or confidentiality/integrity impact; only high availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 19:47 vuln.today

CVE Published

Aug 13, 2026 - 18:51 cve.org

HIGH 7.5

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop.

AnalysisAI

Remote denial of service in IBM i 7.3 through 7.6 is achievable by an unauthenticated network attacker via a CWE-835 infinite loop condition. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no authentication and no user interaction against affected systems. No public exploit code or active exploitation confirmed at time of analysis; IBM has released a patch.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's integrated operating system running on IBM Power Systems hardware, widely used in banking, manufacturing, and government. The vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition), a class of defect where control flow enters a loop that never terminates due to a missing or logically unreachable exit condition. This typically manifests as CPU or thread exhaustion, rendering the system or affected service unresponsive. The CPE string (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) confirms all sub-versions of IBM i 7.3, 7.4, 7.5, and 7.6 are affected, though the specific network-facing subsystem or protocol entry point that triggers the loop is not identified in available data.

RemediationAI

IBM has released a patch addressing this vulnerability, available via the official advisory at https://www.ibm.com/support/pages/node/7283578. Administrators should apply the relevant PTF (Program Temporary Fix) as directed by the advisory for their specific IBM i version (7.3, 7.4, 7.5, or 7.6). The exact patched PTF identifiers are not enumerated in available intelligence data; consult the IBM advisory directly for version-specific fix levels. As a compensating control pending patching, restricting network access to IBM i systems at the perimeter - particularly limiting which external hosts can reach IBM i network services - would reduce the attack surface. However, the specific service triggering the loop is unidentified, making targeted port-level blocking infeasible without vendor clarification.