What is the CVSS score of CVE-2026-17271?

CVE-2026-17271 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by CVE-2026-17271?

IBM i systems (versions 7.3-7.6) are vulnerable to remote, unauthenticated denial-of-service attacks that can disable critical business services-a risk with outsized impact in banking and…. A patch is available.

How to fix or mitigate CVE-2026-17271?

Within 24 hours, identify and inventory all IBM i systems running versions 7.3 through 7.6, determine which systems are remotely accessible, and assess the operational impact of potential outages for each. Within 7 days, obtain the vendor-released patch, test it in a non-production environment mirroring your production configuration, and develop a staged deployment plan prioritizing mission-critical systems in banking and manufacturing operations. Within 30 days, complete deployment of the patch across all affected systems, verify that all business-critical services have resumed normal operation, and confirm patch installation status through vendor-recommended validation procedures.

IBM i CVE-2026-17271

EUVD-2026-57385 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-12 ibm

GHSA-3mjf-x8rp-5rcp

Denial Of Service IBM

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable with no authentication or interaction required; impact is exclusively availability via resource exhaustion; no confidentiality or integrity effect applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 18:38 vuln.today

CVE Published

Aug 12, 2026 - 17:35 nvd

HIGH 7.5

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size.

AnalysisAI

Denial of service in IBM i 7.3 through 7.6 allows an unauthenticated remote attacker to crash or render unavailable affected system services by sending input that bypasses server-side size validation. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling), and the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no special conditions, and no user interaction. IBM i systems typically host irreplaceable mission-critical business workloads in sectors such as banking and manufacturing, making availability disruption disproportionately impactful despite the absence of code execution; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

IBM i (formerly OS/400 and i5/OS) is IBM's vertically integrated operating system for Power Systems hardware, serving as the platform for mission-critical enterprise workloads including ERP, financial transaction processing, and supply chain management. Affected versions 7.3 through 7.6 are identified by CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*. The vulnerability is rooted in CWE-770 - Allocation of Resources Without Limits or Throttling - a class of flaw where the receiving component fails to impose a cap on the size of attacker-controlled input before committing resources (memory, CPU, descriptors) to process it. In practice, this typically manifests as unbounded buffer allocation, queue saturation, or thread exhaustion triggered by a single oversized or malformed network payload. The specific IBM i subsystem or network protocol processing the input is not disclosed in available data; the IBM support advisory at https://www.ibm.com/support/pages/node/7283276 should be consulted for subsystem-level detail.

RemediationAI

IBM has released a patch for this vulnerability; organizations should immediately consult the vendor advisory at https://www.ibm.com/support/pages/node/7283276 to obtain the applicable Program Temporary Fix (PTF) numbers for their installed IBM i release (7.3, 7.4, 7.5, or 7.6). The exact fixed PTF identifiers and Group PTF recommendations are not independently confirmed from the available reference data beyond the advisory URL - do not infer a version number; apply only what the IBM support page specifies for your release and Technology Refresh level. As a compensating control while PTFs are staged for installation, restrict network access to IBM i using IBM i Packet Rules (the integrated host-based firewall) or upstream network firewall rules to limit exposure of affected service ports to trusted source addresses only, accepting the trade-off of reduced external service availability. A network-layer WAF or load balancer with request size limits may provide partial mitigation by dropping oversized payloads before they reach IBM i, but this should not substitute for the vendor-released PTF.