What is the CVSS score of CVE-2026-17276?

CVE-2026-17276 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM i are affected by CVE-2026-17276?

IBM i systems running releases 7.3 through 7.6 are vulnerable to privilege escalation that enables any authenticated user to gain full system authority, creating risk of complete data compromise and…. A patch is available.

How to fix or mitigate CVE-2026-17276?

Within 24 hours, identify and inventory all IBM i systems running versions 7.3 through 7.6 and prioritize those with network exposure or sensitive data storage. Within 7 days, apply the vendor-released patch to all affected production systems and validate that privilege escalation is blocked through access control testing. Within 30 days, complete patching of remaining environments, conduct forensic review of access logs for exploitation attempts, and document the patching completion status for audit purposes.

IBM i CVE-2026-17276

EUVD-2026-57361 CRITICAL

Improper Privilege Management (CWE-269)

2026-08-12 ibm

GHSA-jhv9-vcr5-22m6

Privilege Escalation IBM

9.9

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

CRITICAL

qualitative

NVD

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Authenticated low-privilege user (PR:L) escalates over the network with low complexity; improper authority crosses a security boundary (S:C) yielding total C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 13, 2026 - 16:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 13, 2026 - 16:37 vuln.today

cvss_changed

CVSS changed

Aug 13, 2026 - 16:37 NVD

9.6 (CRITICAL) 9.9 (CRITICAL)

Analysis Generated

Aug 12, 2026 - 18:07 vuln.today

CVE Published

Aug 12, 2026 - 17:20 cve.org

CRITICAL 9.6

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority threads.

AnalysisAI

Privilege escalation in IBM i (formerly OS/400) releases 7.3 through 7.6 lets a remote authenticated user with low privileges gain higher, potentially all-object, authority by abusing improper authorization checks in the handling of high-authority threads. The flaw is scored CVSS 9.9 because of a scope change (S:C) that lets a foothold on the platform lead to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and EPSS is low at 0.24%, but a vendor patch is available.

Technical ContextAI

IBM i is IBM's integrated midrange operating environment (running on Power Systems, historically AS/400) used for core business and ERP workloads, identified here by cpe:2.3:a:ibm:i. The root cause is CWE-269 (Improper Privilege Management): when the OS spawns or manages threads that run under elevated (high) authority, the authorization boundary between the calling user's profile and the privileged thread is not enforced correctly. In IBM i's authority model, user profiles carry special authorities (e.g. *ALLOBJ, *SECADM); a thread that improperly retains or exposes high authority allows a low-authority profile to execute actions with privileges it was never granted, effectively bypassing object-level and adopted-authority controls.

RemediationAI

Patch available per vendor advisory: apply the fixes referenced in IBM support document https://www.ibm.com/support/pages/node/7283292 for your specific IBM i release (7.3, 7.4, 7.5, or 7.6) - exact PTF/PTF-group levels are not enumerated in the available data, so confirm the current level from that page before deploying. Because exploitation requires an authenticated low-privilege foothold, effective compensating controls while scheduling the patch include tightening user-profile provisioning and removing unnecessary special authorities, enforcing least privilege and strong credential/MFA policies on sign-on services, restricting network reachability of IBM i host services to trusted management networks (reducing the AV:N exposure), and increasing audit/journal monitoring (QAUDJRN) for unexpected authority use - with the trade-off that these reduce but do not eliminate risk since the escalation path itself remains until the PTF is applied.