What is the CVSS score of EUVD-2026-58394?

EUVD-2026-58394 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.4%.

Is there a patch available for EUVD-2026-58394?

Yes, a patch is available for EUVD-2026-58394. Update the affected software to the latest version immediately.

IBM i EUVD-2026-58394

| CVE-2026-17076 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-13 ibm

GHSA-rgjg-m2x2-vrr3

Denial Of Service IBM

5.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.3 MEDIUM

DRDA/DDM is a network-facing protocol; resync handling appears pre- or para-authentication per PR:N; impact is availability-only with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 21:10 vuln.today

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper processing of DRDA and DDM resynchronization requests.

AnalysisAI

Denial of service in IBM i 7.3 through 7.6 is achievable remotely without authentication by sending malformed DRDA or DDM resynchronization requests, which the system fails to handle safely due to CWE-770 (unbounded resource allocation). The vulnerability targets IBM's integrated midrange operating system at the network protocol layer, enabling a remote attacker to degrade or disrupt availability of database and distributed data management services. No public exploit code has been identified at time of analysis, and IBM has released a patch via its support portal.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's integrated midrange operating system combining relational database, middleware, and OS functions into a single stack widely used in enterprise sectors. The vulnerability lies in IBM i's handling of DRDA (Distributed Relational Database Architecture) and DDM (Distributed Data Management) - IBM's proprietary network protocols enabling remote relational database access and distributed file operations respectively. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the system fails to constrain resource consumption when processing resynchronization requests within these protocols, allowing a remote party to exhaust server-side resources. The affected CPE is cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*, encompassing all subversions across IBM i 7.3, 7.4, 7.5, and 7.6.

RemediationAI

Apply the IBM-released patch by consulting the vendor advisory at https://www.ibm.com/support/pages/node/7283572 and installing the appropriate PTF for the affected IBM i release (7.3, 7.4, 7.5, or 7.6). Patch availability is confirmed per IBM, but exact PTF identifiers are not reproduced in the available intelligence data and must be retrieved directly from the IBM support page. As a compensating control pending patching, restrict network access to IBM i DRDA service ports (typically TCP/446 and TCP/449) using firewall rules to allow only trusted application servers and database clients - this meaningfully reduces the unauthenticated attack surface, though it may impact legitimate remote database connectivity that relies on those ports being broadly accessible.