What is the CVSS score of EUVD-2026-58231?

EUVD-2026-58231 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by EUVD-2026-58231?

IBM i versions 7.3-7.6 contain an unauthenticated network vulnerability enabling attackers to disable systems and manipulate authentication credentials without providing any credentials.. A patch is available.

How to fix or mitigate EUVD-2026-58231?

Within 24 hours, identify and document all IBM i systems running versions 7.3-7.6 and assess whether they are accessible from untrusted networks. Within 7 days, apply the IBM vendor patch to all affected systems, prioritizing those hosting authentication services or critical business workloads. Within 30 days, verify patch deployment across the entire IBM i estate and review network access controls to restrict unauthorized connectivity to IBM i services.

IBM i EUVD-2026-58231

| CVE-2026-17220 HIGH

Classic Buffer Overflow (CWE-120)

2026-08-13 ibm

GHSA-hq8f-q49p-7786

Buffer Overflow Denial Of Service IBM

8.2

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

8.2 HIGH

Network-reachable unauthenticated service with trivial exploit complexity; availability high for crash potential, integrity low for metadata-only modification, no confidentiality impact evidenced.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 19:22 vuln.today

CVE Published

Aug 13, 2026 - 18:49 nvd

HIGH 8.2

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow.

AnalysisAI

Unauthenticated remote exploitation of a buffer overflow in IBM i 7.3 through 7.6 allows attackers to cause denial of service and modify authentication metadata without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially reachable exploitation over the network against default-accessible services. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

IBM i (formerly OS/400 and i5/OS) is IBM's proprietary integrated operating system for IBM Power Systems midrange servers, widely deployed in banking, insurance, and manufacturing for mission-critical workloads. The root cause is CWE-120 (Classic Buffer Overflow: buffer copy without checking size of input), indicating that a network-accessible component copies externally supplied data into a fixed-size buffer without bounds validation, corrupting adjacent memory. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers the IBM i application stack across all confirmed affected releases: 7.3, 7.4, 7.5, and 7.6. The dual impact - denial of service and authentication metadata modification - suggests the overflow reaches a memory region used by an authentication subsystem, making this more than a simple crash vulnerability.

RemediationAI

IBM has released a patch per vendor advisory at https://www.ibm.com/support/pages/node/7283578; administrators should retrieve and apply the relevant PTFs for their IBM i release (7.3, 7.4, 7.5, or 7.6) as the primary remediation - exact PTF identifiers must be confirmed from the advisory. Patch available per vendor advisory; no independently confirmed fix version number was included in the available intelligence. If immediate PTF application is not feasible, network-level controls should be implemented: restrict inbound access to IBM i network services (particularly those involved in remote authentication flows) to known-trusted IP ranges via firewall policy, reducing exposure to unauthenticated attackers. Note that blanket network restriction may interrupt legitimate remote administration and application connectivity, so coordination with operations teams is required before implementing this workaround.