What is the CVSS score of EUVD-2026-58387?

EUVD-2026-58387 has a CVSS 3.1 base score of 3.8 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.4%.

Is there a patch available for EUVD-2026-58387?

Yes, a patch is available for EUVD-2026-58387. Update the affected software to the latest version immediately.

IBM i EUVD-2026-58387

| CVE-2026-17043 LOW

Path Traversal (CWE-22)

2026-08-13 ibm

GHSA-9q32-h6gm-2v62

Path Traversal IBM

3.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

3.8 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

3.8 LOW

High privileges required for authenticated file management access; only integrity and availability impacted via arbitrary file deletion, with no data disclosure pathway.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:53 vuln.today

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.

AnalysisAI

Path traversal in IBM i 7.3 through 7.6 allows remote authenticated attackers holding high-privilege accounts to delete arbitrary files outside their intended directory scope. The flaw (CWE-22) results from insufficient sanitization of user-supplied path input in a file management operation reachable over the network. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via the IBM support portal.

Technical ContextAI

IBM i (formerly known as OS/400 and i5/OS) is IBM's integrated operating system for IBM Power Systems servers, widely used in enterprise environments for business-critical transaction processing, particularly in banking, manufacturing, and retail. The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a class of flaw where user-controlled input containing sequences such as '../' is used in file system path construction without adequate normalization or boundary enforcement. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) covers all sub-versions across IBM i 7.3, 7.4, 7.5, and 7.6, indicating the flaw is present throughout the current supported release stream. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L) confirms the vulnerable component is network-accessible, that no race condition or environmental complexity is required, and that the impact is confined to integrity and availability - specifically file deletion - without any data disclosure pathway.

RemediationAI

Apply the vendor-released patch documented in the IBM support advisory at https://www.ibm.com/support/pages/node/7283569. The specific PTF identifiers for each affected release level (7.3, 7.4, 7.5, 7.6) are available directly from that advisory and should be confirmed against the installed release before applying. As a compensating control prior to patching, restrict high-privilege IBM i user profiles to the minimum set of trusted administrators and enable object-level auditing (QAUDJRN) to log file deletion operations, which would allow detection of path-traversal-based deletion attempts. Restricting network access to IBM i management interfaces (e.g., via firewall rules limiting which hosts can reach IBM i service ports) reduces exposure further, though it does not eliminate the flaw. Note that privilege reduction is the most effective compensating control given that PR:H is required - ensuring no unnecessary accounts hold elevated authority limits the realistic attack surface to a small, auditable set of principals.