CVE-2026-17015: IBM i Denial of Service Vulnerability

CVE-2026-17015 Overview

CVE-2026-17015 affects IBM i versions 7.6, 7.5, 7.4, and 7.3. The flaw is an out-of-bounds read condition [CWE-125] that permits a remote authenticated attacker to trigger a denial of service and read sensitive information from process memory. Exploitation requires low-level privileges but no user interaction. The issue is exposed over the network, making it reachable by any authenticated user with access to affected IBM i services. IBM published advisory details on its support portal.

Critical Impact
An authenticated remote attacker can crash affected IBM i services and disclose sensitive in-memory data by triggering the out-of-bounds read.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4 and 7.3

Discovery Timeline

2026-08-19 - CVE-2026-17015 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-17015

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] in IBM i. When a vulnerable component processes attacker-controlled input, it reads beyond the intended memory buffer boundary. This out-of-bounds access has two consequences. First, the process can return memory contents that were never intended to be exposed to the caller, resulting in information disclosure. Second, reading unmapped or protected memory pages can terminate the affected process, producing a denial of service condition.

The attack surface is reachable over the network and requires only low privileges, which corresponds to any authenticated IBM i user. No user interaction is required, and the scope remains unchanged. The confidentiality and availability impacts are rated low, while integrity is not affected. The EPSS score is 0.308% with a percentile of 23.6, indicating limited observed exploitation likelihood at publication time.

Root Cause

The root cause is missing or insufficient bounds checking on a memory read operation within an IBM i component. When the boundary condition is not enforced, the affected routine dereferences memory outside the allocated buffer, leaking adjacent bytes or triggering a fault. IBM has not disclosed the specific component or code path in the public advisory. Refer to the IBM Support Page for authoritative technical details.

Attack Vector

An authenticated attacker sends a crafted request to a network-exposed IBM i service. The malformed input causes the vulnerable code path to read past the intended buffer boundary. The attacker either receives leaked memory contents in the service response or observes a service disruption when the read hits inaccessible memory. Because exploitation does not require elevated privileges, any compromised low-privilege account or malicious insider can attempt this attack.

No public proof-of-concept has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the IBM Support Page for vendor-supplied specifics.

Detection Methods for CVE-2026-17015

Indicators of Compromise

Unexpected termination or restart of IBM i services following requests from authenticated user sessions.
Anomalously large or malformed protocol requests originating from low-privilege IBM i accounts.
Repeated authentication events from a single account followed by service errors in IBM i job logs.

Detection Strategies

Correlate IBM i job log crash entries with the source IP and user profile of preceding authenticated requests.
Baseline normal request sizes and structures to affected IBM i network services and alert on deviations.
Monitor for repeated attempts by the same authenticated user to trigger service faults, which indicate probing.

Monitoring Recommendations

Forward IBM i audit journals (QAUDJRN) and service logs to a centralized SIEM for correlation.
Track privileged and low-privilege user activity separately to identify abuse of authenticated access.
Alert on process restarts, memory faults, and abnormal exit codes on affected IBM i releases.

How to Mitigate CVE-2026-17015

Immediate Actions Required

Inventory all IBM i systems running versions 7.6, 7.5, 7.4, and 7.3 and prioritize them for patching.
Apply the IBM-supplied PTFs referenced on the IBM Support Page as soon as they are validated in a test environment.
Restrict network access to IBM i services so only trusted management hosts and users can reach them.
Review and reduce the number of accounts with authenticated access to affected IBM i services.

Patch Information

IBM has published remediation guidance for this vulnerability. Administrators should consult the IBM Support Page for the specific Program Temporary Fixes (PTFs) applicable to each affected release (7.6, 7.5, 7.4, 7.3) and follow standard IBM i PTF installation procedures.

Workarounds

Enforce network segmentation and firewall rules that limit access to IBM i service ports to authorized administrative hosts only.
Disable or restrict access to non-essential IBM i services that expose the vulnerable interface.
Enforce least-privilege on user profiles and revoke authority from accounts that do not require access to affected services.

bash

# Example: restrict IBM i service access at the network layer
# Replace <ibm-i-host> and <mgmt-subnet> with your values
iptables -A INPUT -p tcp -d <ibm-i-host> --dport 449 -s <mgmt-subnet> -j ACCEPT
iptables -A INPUT -p tcp -d <ibm-i-host> --dport 449 -j DROP