What is the CVSS score of EUVD-2026-58395?

EUVD-2026-58395 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.4%.

Is there a patch available for EUVD-2026-58395?

Yes, a patch is available for EUVD-2026-58395. Update the affected software to the latest version immediately.

IBM i EUVD-2026-58395

| CVE-2026-17077 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-08-13 ibm

GHSA-hh5j-34r6-5293

Denial Of Service IBM

5.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.3 MEDIUM

Network-reachable, no authentication, low complexity DoS; availability impact bounded to partial with no confidentiality or integrity exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 21:10 vuln.today

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitialized variable.

AnalysisAI

Denial-of-service in IBM i 7.3 through 7.6 allows a remote unauthenticated attacker to crash or degrade service availability by triggering an uninitialized variable condition (CWE-457) over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, though impact is bounded to partial availability with no confidentiality or integrity exposure. No public exploit code exists and this vulnerability has not been listed in the CISA KEV catalog at time of analysis; a vendor patch is available from IBM.

Technical ContextAI

CWE-457 (Use of Uninitialized Variable) describes a class of defects where a variable is read before being assigned a defined value, producing undefined or attacker-influenced behavior. In this context, a network-reachable code path in IBM i fails to initialize a variable before use, leading to an abnormal termination or degraded availability. IBM i (formerly known as AS/400 and iSeries) is IBM's proprietary integrated operating system running on IBM Power Systems hardware. It is widely used in enterprise and government environments for mission-critical transactional workloads, ERP, and database operations. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all sub-releases of the 7.3, 7.4, 7.5, and 7.6 major versions. The specific network service or subsystem exposing the vulnerable code path is not identified in available data.

RemediationAI

Apply the vendor-released patch by obtaining and installing the appropriate PTFs (Program Temporary Fixes) for the installed IBM i release from the IBM support advisory at https://www.ibm.com/support/pages/node/7283572. Administrators should identify their current Technology Refresh (TR) level for versions 7.3, 7.4, 7.5, or 7.6 and apply the PTF bundle specified in that advisory. Exact PTF numbers are not reproduced here and must be retrieved directly from IBM. As a compensating control prior to patching, restrict network access to IBM i services at the perimeter firewall or network ACL level, limiting reachability to only trusted internal IP ranges; this directly reduces exposure by eliminating unauthenticated remote access to the vulnerable service. Note that the specific network service triggering the vulnerability is not identified in available data, so broad network-layer restriction is the most conservative interim posture.