What is the CVSS score of CVE-2026-17485?

CVE-2026-17485 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM i are affected by CVE-2026-17485?

IBM i systems running versions 7.3 through 7.6 face remote denial of service and data exposure risks via CVE-2026-17485, which requires neither authentication nor sophisticated attack techniques.. A patch is available.

How to fix or mitigate CVE-2026-17485?

Within 24 hours, complete an inventory of all IBM i systems running versions 7.3 through 7.6 and identify which are internet-exposed or accessible from untrusted networks, prioritizing systems handling sensitive data. Within 7 days, obtain and apply the vendor-released patch to all affected IBM i systems, beginning with internet-facing production systems. Within 30 days, complete patch deployment across the entire infrastructure, perform vulnerability rescans to confirm remediation, and update configuration management records.

IBM i CVE-2026-17485

EUVD-2026-57599 HIGH

Out-of-bounds Read (CWE-125)

2026-08-12 ibm

GHSA-2gfx-r93v-m4ph

Buffer Overflow Denial Of Service Information Disclosure IBM

8.2

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

vuln.today AI

8.2 HIGH

Network-reachable with no authentication or interaction needed; out-of-bounds read yields partial memory exposure (C:L) and service crash (A:H) with no integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 22:17 vuln.today

CVE Published

Aug 12, 2026 - 21:24 cve.org

HIGH 8.2

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive information due to an integer underflow.

AnalysisAI

Remote unauthenticated denial of service and sensitive information disclosure in IBM i 7.3 through 7.6 stems from an integer underflow (CWE-125 out-of-bounds read) reachable over the network without authentication. An attacker sending a crafted request can crash an affected service and read portions of process memory, yielding both high availability impact and limited confidentiality exposure. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the low-complexity, unauthenticated attack vector makes it a meaningful risk for internet-exposed IBM i systems.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is an IBM proprietary operating system used heavily in banking, insurance, retail, and manufacturing. The vulnerability is classified as CWE-125 (Out-of-bounds Read), triggered by an integer underflow - a condition where arithmetic produces a value below the minimum representable integer, causing a length or index to wrap to a very large number. This in turn causes the affected component to read memory beyond a valid buffer boundary, which can both expose adjacent memory contents (information disclosure) and crash the process when accessing unmapped regions (denial of service). The affected CPE is cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*, covering all sub-versions of IBM i 7.3, 7.4, 7.5, and 7.6. The specific service, port, or protocol exposing this flaw is not identified in the available data.

RemediationAI

Apply the vendor-released patch per IBM's advisory at https://www.ibm.com/support/pages/node/7282695. IBM has confirmed a patch is available, but exact patched release version numbers were not included in the available intelligence data and must be verified directly from that advisory page. IBM i PTF (Program Temporary Fix) packages are the standard delivery mechanism for OS-level fixes on this platform; administrators should consult the advisory for the relevant PTF numbers by release level. As a compensating control where immediate patching is not possible, restrict network access to IBM i communication ports using perimeter firewall rules or IBM i's own IP filtering (IPFTR) to limit exposure to trusted hosts only - note this does not eliminate risk from trusted-network attackers. Additionally, monitoring for unexpected service crashes or anomalous memory usage on affected systems can aid detection while patch deployment proceeds.