CVE-2026-107674: IBM i Digital Certificate Manager DoS Flaw

CVE-2026-107674 is a denial of service vulnerability in IBM i Digital Certificate Manager affecting versions 7.3 through 7.6. Attackers can prevent secure connections or force fallback to non-secure protocols. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-107674 Overview

IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a denial of service vulnerability in the Digital Certificate Manager (DCM) component used by System TLS. Applications that attempt to establish secure network connections through DCM can be disrupted by a local attacker with high privileges. The flaw can prevent affected services from starting or force them to fall back to non-secure connections, undermining the confidentiality guarantees of TLS. The issue is tracked under CWE-667: Improper Locking.

Critical Impact
An authenticated local attacker can block TLS-enabled services from initializing or coerce them into insecure fallback, exposing network traffic to interception.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-10-16 - CVE-2026-107674 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-107674

Vulnerability Analysis

The vulnerability resides in the Digital Certificate Manager (DCM), the IBM i component responsible for managing digital certificates used by System TLS. Applications requesting a secure TLS connection rely on DCM to supply certificate and key material during the TLS handshake. An improper locking condition disrupts this process when triggered by a local actor with elevated privileges. Services depending on DCM either fail to start or silently downgrade to non-secure connections. The downgrade behavior is the more consequential outcome because applications may continue to operate while transmitting unprotected data.

Root Cause

The root cause is classified as [CWE-667: Improper Locking]. DCM does not correctly manage lock state when servicing concurrent certificate requests from TLS-enabled applications. An attacker with high privileges on the local system can manipulate the locking logic to make certificate resources unavailable to legitimate callers.

Attack Vector

Exploitation requires local access and high privileges on the IBM i system. No user interaction is required. The attacker interacts with DCM in a way that causes resource contention, preventing TLS-dependent services from retrieving the certificates they need. Impacted services either terminate initialization or revert to a non-TLS code path, depending on application logic.

No public proof-of-concept code is available for this vulnerability. Refer to the IBM Support Document for vendor-provided technical details.

Detection Methods for CVE-2026-107674

Indicators of Compromise

Repeated DCM-related errors in the IBM i job log indicating certificate retrieval failures during TLS initialization.
TLS-enabled services failing to start, or starting in a degraded mode that accepts plaintext connections.
Unexpected network traffic from server applications on non-TLS ports following a service restart.

Detection Strategies

Monitor QSYSOPR and application job logs for CPDB8xx and TLS-related diagnostic messages tied to DCM certificate access.
Audit TLS listener ports before and after service restarts to detect unexpected fallback to non-secure protocols.
Correlate privileged user activity against DCM interfaces using IBM i audit journal entries (QAUDJRN).

Monitoring Recommendations

Baseline the expected set of TLS ports exposed by IBM i services and alert on deviations.
Forward IBM i audit journal and job log data to a centralized SIEM for continuous analysis.
Track usage of profiles with *ALLOBJ or *SECADM authority that interact with DCM-related APIs.

How to Mitigate CVE-2026-107674

Immediate Actions Required

Review the IBM Support Document and apply the vendor-supplied PTFs for IBM i 7.3, 7.4, 7.5, and 7.6.
Restrict high-privilege user profiles to the minimum necessary set and audit existing assignments.
Validate that TLS-dependent services do not silently fall back to plaintext after a restart.

Patch Information

IBM has published remediation guidance in the IBM Support Document. Administrators should install the referenced PTFs for the affected IBM i releases and restart impacted services to ensure DCM is reinitialized with the corrected locking behavior.

Workarounds

Limit local access to IBM i systems and remove unnecessary high-privilege accounts.
Configure TLS-dependent applications to fail closed rather than fall back to non-secure connections where supported.
Monitor DCM operations through the audit journal until patches can be applied.

bash

# Example: list user profiles with elevated special authorities on IBM i
# Run from a 5250 session or STRQSH
DSPUSRPRF USRPRF(*ALL) TYPE(*BASIC) OUTPUT(*OUTFILE) OUTFILE(QGPL/USRPRFLST)
RUNQRY QRY(*NONE) QRYFILE((QGPL/USRPRFLST)) \
  RCDSLT('SPCAUT *CT ''*ALLOBJ'' OR SPCAUT *CT ''*SECADM''')