What is the CVSS score of EUVD-2026-57376?

EUVD-2026-57376 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by EUVD-2026-57376?

IBM i systems running versions 7.3 through 7.6 are vulnerable to remote denial-of-service attacks via malformed TCP options, causing service outages without requiring authentication or user…. A patch is available.

How to fix or mitigate EUVD-2026-57376?

Within 24 hours, inventory all IBM i systems in your environment and identify those running versions 7.3-7.6 that are reachable from the network. Within 7 days, obtain the vendor patch from IBM and prepare a deployment plan prioritizing systems serving business-critical functions. By day 30, complete patch deployment across all vulnerable instances and validate TCP/IP stack stability post-update.

IBM i EUVD-2026-57376

| CVE-2026-16931 HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-08-12 ibm

GHSA-mgmf-cpqx-c6qc

Denial Of Service IBM

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

TCP is network-reachable with no authentication and trivial complexity (AV:N, AC:L, PR:N, UI:N); CWE-835 infinite loop causes complete availability loss (A:H) with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 18:40 vuln.today

CVE Published

Aug 12, 2026 - 17:27 nvd

HIGH 7.5

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options.

AnalysisAI

IBM i versions 7.3 through 7.6 expose their TCP/IP stack to a remotely-triggered denial of service when processing zero-length TCP option fields. Classified as CWE-835 (Loop with Unreachable Exit Condition), the flaw causes the TCP stack to enter an infinite or unrecoverable processing loop upon receipt of malformed TCP options, exhausting CPU or thread resources and disrupting hosted business services. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N CVSS vector means any network-reachable IBM i system is exploitable without credentials or special conditions.

Technical ContextAI

IBM i is IBM's proprietary operating system for Power Systems hardware (formerly AS/400 and iSeries), widely used for mission-critical ERP, financial, and manufacturing workloads. The vulnerability resides in the kernel-level TCP/IP option parser. RFC 793 and its extensions define variable-length TCP options; a zero-length option is a degenerate, malformed case that a robust implementation must reject gracefully. Here, CWE-835 indicates the parser instead enters a loop with an unreachable exit condition - likely iterating over option bytes while expecting a non-zero length to advance the parse pointer, causing it to spin indefinitely on the zero-length field. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all IBM i versions in the affected range (7.3, 7.4, 7.5, 7.6), and the flaw is independent of any higher-layer application or configuration.

RemediationAI

IBM has released PTF-based patches for all affected releases (7.3, 7.4, 7.5, and 7.6), available through the vendor advisory at https://www.ibm.com/support/pages/node/7283288. Administrators should consult that advisory for the specific PTF number applicable to their IBM i release and apply it following standard IBM i service application procedures. Exact patched version identifiers were not independently confirmed from available intelligence data - the advisory should be treated as the authoritative source. As a compensating control prior to patching, perimeter firewalls or network intrusion prevention systems capable of inspecting TCP option fields and dropping packets with zero-length options can block malicious traffic, though this requires hardware with deep TCP inspection capability and may not be available in all environments. Restricting inbound TCP access to IBM i systems to known trusted IP ranges reduces the attack surface and is advisable regardless of patch status, since IBM i systems rarely require broad inbound TCP exposure.