What is the CVSS score of CVE-2026-4942?

CVE-2026-4942 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-4942?

Yes, a patch is available for CVE-2026-4942. Update the affected software to the latest version immediately.

IBM i CVE-2026-4942

EUVD-2026-45292 HIGH

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') (CWE-757)

2026-07-17 ibm

GHSA-cffx-9q2g-r6hp

IBM Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.9 MEDIUM

MitM positioning required for handshake interception justifies AC:H; no auth or user interaction needed; only confidentiality impacted via traffic decryption.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Aug 12, 2026 - 19:07 NVD

MEDIUM HIGH

CVSS changed

Aug 12, 2026 - 19:07 NVD

5.9 (MEDIUM) 7.5 (HIGH)

Analysis Generated

Jul 17, 2026 - 20:17 vuln.today

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to send a specifically crafted message and downgrade the Transport Layer Security (TLS) protocol to a version disabled in the server configuration.

AnalysisAI

TLS protocol downgrade in IBM i 7.3 through 7.6 enables remote attackers to force negotiation of TLS versions explicitly disabled in the server configuration, undermining the operator's security posture by exposing session traffic to potential decryption. The CVSS vector (AV:N/AC:H/PR:N) confirms this is network-exploitable without authentication but requires high attack complexity, consistent with a man-in-the-middle positioning requirement during the TLS handshake. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; a vendor patch is available per IBM advisory 7278992.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's proprietary operating system for Power Systems midrange servers, widely deployed in banking, insurance, and government for mission-critical workloads. The vulnerability is classified as CWE-757 (Selection of Less-Secure Algorithm During Negotiation - Algorithm Downgrade), a class of flaw in which an adversary manipulates the protocol negotiation handshake to coerce both parties into using a weaker cryptographic algorithm or protocol version than the server's policy permits. In TLS, this manifests during the ClientHello/ServerHello exchange: a crafted message can trick the IBM i TLS stack into accepting a disabled version (e.g., TLS 1.0 or TLS 1.1) even when those versions have been administratively prohibited. The affected CPE is cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*, covering IBM i versions 7.3, 7.4, 7.5, and 7.6.

RemediationAI

Apply the vendor-supplied patch documented in IBM Support page 7278992 at https://www.ibm.com/support/pages/node/7278992 for affected IBM i versions 7.3, 7.4, 7.5, and 7.6. The advisory reference confirms patch availability; however, an exact fixed-release version number was not independently confirmed from the provided data - consult IBM Support directly for PTF (Program Temporary Fix) identifiers applicable to your release level. As a compensating control while patching is scheduled, network-level controls restricting which clients can initiate TLS sessions to IBM i services will reduce exposure by limiting MitM opportunities - this is most effective in environments where IBM i is not broadly internet-accessible. Note that network ACLs do not eliminate the vulnerability and should not substitute for patching.