What is the CVSS score of CVE-2026-17417?

CVE-2026-17417 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by CVE-2026-17417?

IBM i systems running versions 7.3 through 7.6 are vulnerable to remote command injection that allows authenticated attackers to execute arbitrary OS commands with full system compromise.. A patch is available.

How to fix or mitigate CVE-2026-17417?

Within 24 hours, identify and inventory all IBM i systems in production running versions 7.3 through 7.6 and confirm whether they accept authenticated remote connections. Within 7 days, deploy the vendor-released patch from IBM's security advisory at https://www.ibm.com/support/pages/node/7283275 to all affected systems, prioritizing internet-facing and mission-critical instances. Within 30 days, complete patch deployment across the entire IBM i environment and conduct functional validation testing to ensure business process continuity.

IBM i CVE-2026-17417

EUVD-2026-57517 HIGH

OS Command Injection (CWE-78)

2026-08-12 ibm

GHSA-vpvh-vjcg-6mcc

Command Injection IBM

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible service with no special conditions; PR:L because any valid authenticated user account suffices; full C/I/A from arbitrary command execution with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:28 vuln.today

CVE Published

Aug 12, 2026 - 19:32 nvd

HIGH 8.8

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters.

AnalysisAI

Remote command injection in IBM i 7.3 through 7.6 allows a network-accessible authenticated attacker to execute arbitrary OS commands by supplying shell metacharacters in unsanitized input, resulting in full confidentiality, integrity, and availability compromise of the affected system. IBM confirmed and patched this vulnerability, documented at https://www.ibm.com/support/pages/node/7283275. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication bar make this a credible threat to any internet-exposed IBM i environment.

Technical ContextAI

IBM i (formerly AS/400, iSeries) is IBM's integrated operating system running exclusively on IBM Power Systems hardware, widely deployed in banking, insurance, manufacturing, and government. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that user-supplied input containing shell metacharacters such as semicolons, pipes, or command substitution sequences is passed unsanitized into an OS command interface, causing the system to execute attacker-controlled instructions. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* confirms all minor releases within major versions 7.3, 7.4, 7.5, and 7.6 fall within scope. The specific IBM i subsystem, CL command interface, or network-accessible service component containing the flaw is not identified in the available data.

RemediationAI

Apply the vendor-released Program Temporary Fix (PTF) documented in IBM's support advisory at https://www.ibm.com/support/pages/node/7283275; PTF identifiers vary by release level (7.3, 7.4, 7.5, 7.6) and must be retrieved directly from that advisory. The exact patched PTF numbers are available in the IBM advisory but not reproduced in available intelligence data. If immediate patching is not feasible, restrict network access to the vulnerable IBM i service using host-based IBM i exit programs (registered via WRKREGINF) to control which IP addresses and user profiles can invoke the affected interface, and apply firewall rules to limit inbound access to known trusted hosts. Review and disable accounts with access to the vulnerable component that do not require it; revoke *ALLOBJ and elevated special authorities from service accounts where possible to limit command execution impact. Note that network-layer blocking may not fully mitigate risk if the vulnerable interface serves legitimate business functions, making patching the only complete remediation.