EUVD-2026-57599
GHSA-2gfx-r93v-m4ph
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-accessible IBM i system
-
DeliverySend crafted malformed network request
-
ExploitTrigger integer underflow in input processing
-
ExecutionOut-of-bounds read reads adjacent memory
-
ImpactLeak sensitive memory contents or crash service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration or authentication is required - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote unauthenticated exploitation against default configurations of IBM i 7.3, 7.4, 7.5, and 7.6. The specific network service, port, or protocol involved is not identified in the available data, which limits defenders' ability to apply targeted firewall rules. Exploitation is limited by network reachability to the IBM i system; systems isolated behind firewalls or private network segments face significantly reduced exposure. The exact triggering input format is unknown as no exploit code has been identified. |
| Impact | The CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) indicates a high-severity, remotely exploitable vulnerability requiring no authentication or user interaction, with low attack complexity - a combination that supports mass scanning and opportunistic exploitation. The high availability impact (A:H) combined with low confidentiality impact (C:L) suggests service disruption is the primary real-world risk, with memory leakage as a secondary concern. No EPSS score was provided in the intelligence data; this is a notable gap for real-world prioritization. This CVE is not in the CISA KEV catalog and no public exploit code is known, which moderates urgency somewhat. However, the unauthenticated network vector on a platform deeply embedded in critical financial and manufacturing infrastructure raises the business impact potential significantly above what a raw CVSS number conveys. IBM i systems are often long-lived and infrequently patched - defenders should treat this as a real-world priority, especially for internet-facing deployments. |
| Exploit ScenarioDerived | An attacker with network access to an IBM i system crafts a malformed network request targeting the vulnerable service, supplying input that triggers an integer underflow in the length calculation logic. The resulting out-of-bounds read either crashes the service (denial of service) or returns memory contents to the attacker (sensitive information disclosure). Because no authentication or user interaction is required, this attack is scriptable and can be executed remotely against any reachable IBM i 7.3-7.6 installation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 12, 2026
Remote unauthenticated denial of service and sensitive information disclosure in IBM i 7.3 through 7.6 stems from an integer underflow (CWE-125 out-of-bounds read) reachable over the network without authentication. An attacker sending a crafted request can crash an affected service and read portions of process memory, yielding both high availability impact and limited confidentiality exposure. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the low-complexity, unauthenticated attack vector makes it a meaningful risk for internet-exposed IBM i systems.
RemediationAI
Apply the vendor-released patch per IBM's advisory at https://www.ibm.com/support/pages/node/7282695. IBM has confirmed a patch is available, but exact patched release version numbers were not included in the available intelligence data and must be verified directly from that advisory page. IBM i PTF (Program Temporary Fix) packages are the standard delivery mechanism for OS-level fixes on this platform; administrators should consult the advisory for the relevant PTF numbers by release level. As a compensating control where immediate patching is not possible, restrict network access to IBM i communication ports using perimeter firewall rules or IBM i's own IP filtering (IPFTR) to limit exposure to trusted hosts only - note this does not eliminate risk from trusted-network attackers. Additionally, monitoring for unexpected service crashes or anomalous memory usage on affected systems can aid detection while patch deployment proceeds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM i (formerly AS/400 and iSeries) is an IBM proprietary operating system used heavily in banking, insurance, retail, and manufacturing. The vulnerability is classified as CWE-125 (Out-of-bounds Read), triggered by an integer underflow - a condition where arithmetic produces a value below the minimum representable integer, causing a length or index to wrap to a very large number. This in turn causes the affected component to read memory beyond a valid buffer boundary, which can both expose adjacent memory contents (information disclosure) and crash the process when accessing unmapped regions (denial of service). The affected CPE is cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*, covering all sub-versions of IBM i 7.3, 7.4, 7.5, and 7.6. The specific service, port, or protocol exposing this flaw is not identified in the available data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Network-reachable with no authentication or interaction needed; out-of-bounds read yields partial memory exposure (C:L) and service crash (A:H) with no integrity impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive information due to an integer underflow.
Executive ViewAI
IBM i systems running versions 7.3 through 7.6 face remote denial of service and data exposure risks via CVE-2026-17485, which requires neither authentication nor sophisticated attack techniques. Any organization with internet-connected IBM i infrastructure is immediately vulnerable and at risk of service outages and sensitive data leakage. Patching should be prioritized as this vulnerability affects the availability and confidentiality of systems commonly used for critical enterprise operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB