What is the CVSS score of CVE-2026-17272?

CVE-2026-17272 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM i are affected by CVE-2026-17272?

IBM i versions 7.3-7.6 face unauthenticated remote denial-of-service risk through a buffer overflow flaw, allowing any internet-connected attacker to crash midrange systems without credentials; no…. A patch is available.

How to fix or mitigate CVE-2026-17272?

Within 24 hours, inventory all IBM i systems and identify those running versions 7.3-7.6, prioritizing production systems for patching. Within 7 days, contact IBM support to obtain vendor-released patches, and conduct testing in non-production environments to validate compatibility and stability before deployment. Within 30 days, deploy patches to all affected production systems using a staged rollout to minimize operational risk.

IBM i CVE-2026-17272

EUVD-2026-58404 HIGH

Out-of-bounds Write (CWE-787)

2026-08-13 ibm

GHSA-gwjw-w9j8-w6rh

Buffer Overflow Denial Of Service Memory Corruption IBM

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

8.2 HIGH

Network-reachable unauthenticated path confirmed by description; out-of-bounds write yields high availability and limited integrity impact with no confidentiality loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Aug 19, 2026 - 16:52 NVD

8.2 (HIGH) 7.5 (HIGH)

Analysis Generated

Aug 13, 2026 - 21:06 vuln.today

CVE Published

Aug 13, 2026 - 20:28 cve.org

HIGH 8.2

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.

AnalysisAI

Denial of service via buffer overflow in IBM i 7.3 through 7.6 exposes all supported release lines of IBM's midrange operating system to remote disruption. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that an unauthenticated remote attacker can trigger the flaw with low complexity and no user interaction, resulting in high availability impact and limited integrity impact - consistent with an out-of-bounds write that can crash or destabilize a targeted component. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is a proprietary midrange operating system running on IBM Power Systems hardware, widely deployed in enterprise and government environments for mission-critical workloads. The flaw is classified as CWE-787 (Out-of-Bounds Write), indicating that a network-reachable component writes data past the end of an allocated buffer, which on IBM i can corrupt adjacent memory and destabilize the affected service or system component. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all sub-versions of the IBM i application platform across the four affected release lines: 7.3, 7.4, 7.5, and 7.6. The network-accessible attack vector implies the vulnerable code path is reachable via a network service exposed by IBM i - the specific service or port is not identified in the available data.

RemediationAI

The primary remediation is to apply the vendor-released patch documented in IBM's support advisory at https://www.ibm.com/support/pages/node/7283295. IBM has confirmed patch availability, but the exact PTF (Program Temporary Fix) identifiers and minimum fix versions are not specified in the available data - administrators should consult the advisory directly to obtain the correct PTF numbers for their release level (7.3, 7.4, 7.5, or 7.6). As a compensating control prior to patching, consider restricting network access to the IBM i system at the perimeter firewall or network layer to limit exposure of whatever service is vulnerable; however, because the specific port or service is unidentified from available data, blanket egress/ingress restriction to known-necessary services is the most actionable interim step. Note that network restriction may affect legitimate business traffic to the system and should be coordinated with application owners before implementation.