What is the CVSS score of EUVD-2026-58460?

EUVD-2026-58460 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM i are affected by EUVD-2026-58460?

IBM i systems running versions 7.3 through 7.6 are vulnerable to a remote denial-of-service attack from unauthenticated network sources, affecting organizations reliant on these systems for business…. A patch is available.

How to fix or mitigate EUVD-2026-58460?

Within 24 hours, inventory all IBM i systems and identify which are running versions 7.3, 7.4, 7.5, or 7.6. Within 7 days, obtain the vendor patch and test it in a non-production environment to confirm compatibility and stability. Within 30 days, deploy the patch to all affected production systems, starting with those supporting business-critical operations.

IBM i EUVD-2026-58460

| CVE-2026-17502 HIGH

Out-of-bounds Write (CWE-787)

2026-08-13 ibm

GHSA-xg8m-56gm-9394

Buffer Overflow Denial Of Service Memory Corruption IBM

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

8.2 HIGH

Network unauthenticated OOB write confirms AV:N/PR:N; confirmed DoS outcome sets A:H; OOB write may corrupt adjacent memory setting I:L; no confidentiality impact stated in description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Aug 19, 2026 - 16:37 NVD

8.6 (HIGH) 7.5 (HIGH)

Analysis Generated

Aug 13, 2026 - 21:41 vuln.today

CVE Published

Aug 13, 2026 - 20:40 nvd

HIGH 8.6

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.

AnalysisAI

Out-of-bounds write (CWE-787) in IBM i versions 7.3 through 7.6 enables remote unauthenticated attackers to crash affected systems and cause denial of service. The CVSS 3.1 base score of 8.6 is backed by a network-reachable, zero-prerequisite attack vector spanning all four currently supported IBM i release lines, making the exposed attack surface broad. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog; however, a vendor-released patch is available and should be applied promptly given the unauthenticated network vector.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's integrated operating system and application platform, identified by CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*, widely deployed in enterprise banking, manufacturing, and government environments. The vulnerability is rooted in CWE-787 (Out-of-Bounds Write), a memory corruption class in which a program writes data beyond the allocated buffer boundary, overwriting adjacent memory structures. IBM's own tags confirm a buffer overflow mechanism: a specially crafted network payload causes the affected IBM i component to write past its buffer, corrupting heap or stack memory and leading to service or system crash. The tags 'Memory Corruption' and 'Buffer Overflow' from IBM are consistent with CWE-787 semantics. All four currently supported IBM i major release lines - 7.3, 7.4, 7.5, and 7.6 - are confirmed affected.

RemediationAI

IBM has released a patch for CVE-2026-17502; administrators should apply the appropriate PTF (Program Temporary Fix) or cumulative package for their specific IBM i release (7.3, 7.4, 7.5, or 7.6) as identified in the IBM support advisory at https://www.ibm.com/support/pages/node/7283573. The exact PTF numbers are not reproduced in the available intelligence and must be retrieved directly from that advisory. If immediate patching is not operationally feasible, a compensating control is to restrict network access to the affected IBM i service at the perimeter or host-based firewall level, limiting reachability from untrusted networks; this reduces direct exposure but does not eliminate the underlying vulnerability and may affect legitimate service availability. Patching remains the definitive fix.