What is the CVSS score of CVE-2026-17248?

CVE-2026-17248 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM i are affected by CVE-2026-17248?

CVE-2026-17248 affects IBM i systems versions 7.3 through 7.6, allowing network-based authenticated attackers to execute arbitrary OS commands and disrupt critical system availability.. A patch is available.

How to fix or mitigate CVE-2026-17248?

Within 24 hours, complete an inventory of all IBM i systems running versions 7.3 through 7.6 and document network accessibility for each. Within 7 days, obtain the vendor patch from IBM, apply it to test environments, and validate system stability including user authentication workflows and dependent applications. Within 30 days, deploy the patch to all affected production systems according to IBM's recommended change management procedures, prioritizing systems supporting critical business functions and those with external network access.

IBM i CVE-2026-17248

EUVD-2026-57386 MEDIUM

OS Command Injection (CWE-78)

2026-08-12 ibm

GHSA-2prm-gf75-cp8m

Denial Of Service Command Injection IBM

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.1 HIGH

Network-reachable exploitation requiring low-privilege authentication; DoS primary with no confidentiality loss and only minor integrity exposure from command injection root cause.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Aug 13, 2026 - 16:37 NVD

HIGH MEDIUM

CVSS changed

Aug 13, 2026 - 16:37 NVD

7.1 (HIGH) 6.5 (MEDIUM)

Analysis Generated

Aug 12, 2026 - 18:38 vuln.today

CVE Published

Aug 12, 2026 - 17:35 nvd

HIGH 7.1

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command.

AnalysisAI

OS command injection in IBM i 7.3 through 7.6 enables remote authenticated attackers to disrupt system availability by submitting crafted input containing special elements that are improperly neutralized before being passed to OS-level commands. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) confirms network-reachable exploitation requiring only low-privilege credentials, with high availability impact and a secondary low integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across actively supported IBM i releases make patching a priority for affected IBM Power Systems environments.

Technical ContextAI

IBM i (formerly OS/400 and i5/OS) is the proprietary operating system running on IBM Power Systems midrange servers, widely deployed in regulated industries such as banking, insurance, and retail for mission-critical workloads. The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning that user-supplied input is incorporated into an operating system command without adequate sanitization or escaping of shell metacharacters. This allows an attacker to manipulate the constructed command string, redirecting control flow or injecting additional commands. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* indicates the vulnerability spans all sub-versions of IBM i 7.3, 7.4, 7.5, and 7.6, covering the full currently-supported release family. The integrity impact (I:L) alongside the dominant availability impact (A:H) suggests that while the primary observable effect is denial of service, the command injection root cause inherently carries some capacity for limited data or state manipulation.

RemediationAI

IBM has released a patch for this vulnerability, available through the IBM support portal at https://www.ibm.com/support/pages/node/7283276. Administrators should apply the relevant PTF package for their IBM i release level (7.3, 7.4, 7.5, or 7.6) as documented in that bulletin; no exact consolidated fix version number is independently confirmable from the available intelligence, so the vendor advisory should be used as the authoritative source for PTF numbers. As a compensating control prior to patching, organizations can restrict network access to IBM i interfaces that accept the vulnerable input, audit and limit which low-privilege accounts have access to the affected functionality, and review IBM i object-level security and adopted authority settings to reduce the scope of any command execution. These controls do not eliminate the vulnerability but reduce the attacker pool and potential impact.