What is the CVSS score of CVE-2026-17268?

CVE-2026-17268 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-17268?

Yes, a patch is available for CVE-2026-17268. Update the affected software to the latest version immediately.

IBM i CVE-2026-17268

EUVD-2026-57362 MEDIUM

Authentication Bypass by Capture-replay (CWE-294)

2026-08-12 ibm

GHSA-233j-99x7-fjj5

Authentication Bypass IBM

6.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

Network-reachable but requires authenticated foothold (PR:L) and high-complexity token capture (AC:H); no availability impact applies per description.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 18:10 vuln.today

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token.

AnalysisAI

Session token validation bypass in IBM i versions 7.3 through 7.6 enables a remote low-privileged attacker to circumvent security restrictions by exploiting improper session token handling (CWE-294). The CVSS vector confirms network reachability but mandates high attack complexity and an existing authenticated foothold, capping the score at 6.8 Medium. No public exploit code or CISA KEV listing has been identified at time of analysis, and IBM has issued a vendor patch.

Technical ContextAI

IBM i (formerly OS/400 and i5/OS) is IBM's proprietary operating system for Power Systems servers, tightly integrated with hardware and commonly deployed in banking, manufacturing, and government verticals. CWE-294 (Authentication Bypass by Capture-Replay) describes a class of flaw where session tokens are insufficiently validated - enabling scenarios such as token replay, session fixation, or token forgery that allow an attacker to assume the identity or privileges of another session. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* scopes all sub-releases of the IBM i platform, with the CVE description explicitly naming supported release trains 7.3, 7.4, 7.5, and 7.6. The CVSS Scope:Unchanged metric indicates that successful exploitation does not cross privilege boundaries to affect other system components beyond the vulnerable session context.

RemediationAI

Apply the vendor-supplied patch referenced in IBM Security Advisory at https://www.ibm.com/support/pages/node/7283292. IBM i patches are distributed as PTFs (Program Temporary Fixes); administrators should retrieve the applicable PTF for their specific release (7.3, 7.4, 7.5, or 7.6) through the IBM Fix Central portal or their support contract channel. An exact replacement PTF number is not independently confirmed from the provided data - consult the advisory directly for the authoritative PTF identifier. As a compensating control prior to patching, restrict network access to IBM i session management interfaces (particularly Telnet port 23, DDM port 446, and any exposed management endpoints) to trusted internal networks only, reducing the network-accessible attack surface while the patch is staged. Note that network restriction does not eliminate the vulnerability but raises the bar for exploitation by requiring local network adjacency.