CVE-2026-17057: IBM i DOS Vulnerability

CVE-2026-17057 is a denial of service vulnerability in IBM i versions 7.3 through 7.6 caused by missing authentication for critical functions. Attackers can exploit this to disrupt services and compromise data integrity. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-17057 Overview

CVE-2026-17057 is a missing authentication vulnerability affecting IBM i operating system versions 7.3, 7.4, 7.5, and 7.6. A remote attacker can trigger a denial of service condition and compromise data integrity without providing credentials. The flaw is classified under [CWE-306] (Missing Authentication for Critical Function) and requires no user interaction to exploit over the network.

Critical Impact
Unauthenticated remote attackers can disrupt IBM i services and modify data integrity across all currently supported IBM i releases.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-09-04 - CVE-2026-17057 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-17057

Vulnerability Analysis

CVE-2026-17057 exists because a critical function within IBM i does not enforce authentication before processing requests. Remote attackers reach the vulnerable component over the network without credentials or user interaction. Successful exploitation impacts both integrity and availability of the target system while leaving confidentiality unaffected.

Because IBM i runs core business workloads on IBM Power systems, exposure of an unauthenticated network-facing function creates operational risk for ERP, database, and application services hosted on the platform. All four IBM i releases currently under support are affected.

Root Cause

The root cause is missing authentication for a critical function, mapped to [CWE-306]. The affected component accepts and processes requests without validating the identity of the caller. This design gap allows any network-reachable actor to invoke privileged behavior that should be restricted to authorized principals.

Attack Vector

Exploitation occurs over the network against an exposed IBM i service. The attacker sends crafted requests to the vulnerable interface to trigger denial of service or unauthorized modification of data. No prior privileges, credentials, or user interaction are required, which lowers the barrier to exploitation for internal attackers and any actors with reachability to the service.

The vulnerability manifests in an authentication check that is absent from the request-handling path. See the IBM Support Page Advisory for vendor-specific technical details.

Detection Methods for CVE-2026-17057

Indicators of Compromise

Unexpected service restarts, subsystem terminations, or QSYSOPR messages indicating abnormal termination of IBM i services.
Unauthorized modifications to database files, journaled objects, or configuration data without a corresponding authenticated user session in audit journals.
Inbound network traffic to IBM i services from unexpected source addresses, particularly outside normal administrative segments.

Detection Strategies

Review the IBM i security audit journal (QAUDJRN) for anomalous access patterns and object modification entries without associated authenticated jobs.
Correlate network flow data with IBM i job logs to identify requests reaching sensitive services without prior authentication events.
Baseline normal service availability and alert on repeated denial of service symptoms such as connection resets or unresponsive listeners.

Monitoring Recommendations

Ingest IBM i audit journal data and system operator messages into a centralized SIEM for continuous correlation.
Monitor network exposure of IBM i services and alert on new external reachability to management or application ports.
Track EPSS movement for CVE-2026-17057, currently reported at 0.38%, to detect changes in exploitation likelihood.

How to Mitigate CVE-2026-17057

Immediate Actions Required

Apply the fixes referenced in the IBM Support Page Advisory for IBM i 7.3, 7.4, 7.5, and 7.6.
Inventory all IBM i partitions and confirm the running PTF levels against the vendor advisory.
Restrict network reachability to affected IBM i services using firewall rules and network segmentation until patches are deployed.

Patch Information

IBM has published remediation guidance for CVE-2026-17057 in its support portal. Administrators should apply the Program Temporary Fixes (PTFs) listed in the IBM Support Page Advisory for each affected release: 7.3, 7.4, 7.5, and 7.6.

Workarounds

Limit inbound access to IBM i services to trusted administrative networks using perimeter and host-based firewalls.
Disable or restrict any non-essential network-facing services on affected IBM i partitions until PTFs are applied.
Increase monitoring of the QAUDJRN audit journal and system operator messages to detect exploitation attempts during the patch window.

bash

# Example: verify installed PTF group level on IBM i (run from a 5250 session)
WRKPTFGRP

# Example: display security audit journal entries for review
DSPJRN JRN(QSYS/QAUDJRN) JRNCDE(T) ENTTYP(*ALL)