What is the CVSS score of EUVD-2026-58239?

EUVD-2026-58239 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by EUVD-2026-58239?

IBM i servers running versions 7.3 through 7.6 are vulnerable to remote denial-of-service attacks that require no credentials or user interaction, allowing attackers to crash systems with malformed…. A patch is available.

How to fix or mitigate EUVD-2026-58239?

Within 24 hours, identify all IBM i systems running versions 7.3 through 7.6 and restrict network access from untrusted sources where operationally feasible. Within 7 days, obtain the patch available from IBM's support portal, test it in a non-production environment against your critical applications, and establish a phased deployment schedule. Within 30 days, deploy the patch across all affected systems beginning with externally-facing IBM i hosts, validate functionality post-deployment, and confirm the patch version via IBM's support documentation.

IBM i EUVD-2026-58239

| CVE-2026-18846 HIGH

Out-of-bounds Write (CWE-787)

2026-08-13 ibm

GHSA-457c-p98r-9wg6

Buffer Overflow Memory Corruption IBM

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Host server accepts unauthenticated network connections (AV:N, PR:N, AC:L); impact is process crash only with no confidentiality or integrity effect (A:H, C:N, I:N, S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 19:50 vuln.today

CVE Published

Aug 13, 2026 - 18:58 cve.org

HIGH 7.5

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a buffer overflow from improperly validating client data. By sending malformed requests to one of the host servers, a remote attacker could leverage this vulnerability to cause a denial-of-server (DoS) for that server.

AnalysisAI

Remote denial-of-service in IBM i 7.3 through 7.6 allows unauthenticated network attackers to crash a host server by submitting malformed requests that trigger an out-of-bounds write (CWE-787) in the server's client data validation logic. The CVSS vector confirms no credentials or user interaction are required, making the attack straightforward to attempt against any network-reachable IBM i host server. No public exploit code has been identified at time of analysis, and IBM has released a patch via their support portal.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's integrated operating system for Power Systems hardware, widely deployed in enterprise and government environments for mission-critical transactional workloads. The platform exposes a suite of 'host servers' - network-accessible service daemons (such as DDM, DRDA, Database, Data Transfer, and others) that accept remote client connections. The root cause is CWE-787 (Out-of-bounds Write): the affected host server fails to properly validate the length or content of client-supplied data before writing it into a fixed-size buffer, allowing the write to overflow into adjacent memory and crash the process. CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers the IBM i software platform; the description constrains affected releases to 7.3, 7.4, 7.5, and 7.6. The specific host server component involved is not named in the available description and must be confirmed via the IBM advisory.

RemediationAI

IBM has made a patch available; administrators should apply the appropriate PTF for their IBM i release (7.3, 7.4, 7.5, or 7.6) by consulting the vendor advisory at https://www.ibm.com/support/pages/node/7283578 for the exact PTF identifiers - no specific fixed version number was independently confirmed in the available intelligence beyond vendor confirmation of patch availability. As a compensating control prior to patching, network access to the affected IBM i host server port(s) should be restricted using IBM i network security rules or perimeter firewall policy to limit inbound connections to trusted hosts only; this reduces attack surface but does not remediate the underlying flaw and may affect legitimate remote application connectivity. If the specific host server is not operationally required, disabling it entirely via the IBM i host server configuration eliminates the attack surface for that service, though dependent applications must be identified and assessed before doing so.