CVE-2026-17073: IBM i Information Disclosure Vulnerability

CVE-2026-17073 Overview

CVE-2026-17073 affects IBM i versions 7.3, 7.4, 7.5, and 7.6. The vulnerability allows a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution. The weakness is classified as improper access control [CWE-284].

An authenticated user on an affected IBM i system can resolve file handles outside of expected directory boundaries. This produces unintended read access to data the user should not be able to view. IBM published an advisory addressing the issue on the IBM Support Page.

Critical Impact
Local authenticated users can read sensitive files outside their authorized directory scope by exploiting missing subtree validation in file handle resolution.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-10-16 - CVE-2026-17073 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-17073

Vulnerability Analysis

The vulnerability resides in the file handle resolution logic of the IBM i integrated file system. When the system resolves a file handle, it fails to perform a subtree check that confirms the resolved object sits within the directory tree the caller is authorized to access.

Without this check, a local user can supply or obtain a handle that references a file in a parent or sibling directory. The resolver returns a usable reference to that object. The user then reads content that should be isolated by the directory hierarchy.

The impact is limited to confidentiality and integrity exposure of files reachable through handle manipulation. Availability of the system is not affected. The classification under [CWE-284] reflects the broken access boundary rather than a memory safety defect.

Root Cause

The root cause is a missing authorization check during file handle resolution. The code path trusts that a provided handle already corresponds to an authorized object. It does not re-validate that the target resides within the subtree the caller holds rights to.

Attack Vector

Exploitation requires local, authenticated access to an IBM i system. The attacker uses standard file system APIs to acquire or craft a handle, then issues read operations against resolved paths that bypass the intended directory boundary. No user interaction is required beyond the attacker's own session.

No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-17073

Indicators of Compromise

Unexpected file open or read operations by user profiles against objects outside their home directory subtree.
Audit journal entries showing successful access to integrated file system paths that fall outside documented user permissions.
Anomalous use of file handle APIs from interactive or batch jobs owned by low-privilege user profiles.

Detection Strategies

Enable and review the IBM i security audit journal (QAUDJRN) with *AUTFAIL and *OBJAUD values to capture file access attempts.
Correlate file access events against expected user-to-directory mappings and alert on crossings of subtree boundaries.
Baseline normal integrated file system access patterns per user profile and investigate deviations.

Monitoring Recommendations

Forward IBM i audit journal events to a centralized analytics platform for cross-session correlation.
Monitor privileged profile activity and application service accounts for atypical read patterns against sensitive directories.
Track volume and diversity of file objects accessed per session to flag enumeration behavior.

How to Mitigate CVE-2026-17073

Immediate Actions Required

Review the IBM Support Page and apply the vendor-supplied PTFs for IBM i 7.3, 7.4, 7.5, and 7.6.
Inventory IBM i systems and confirm the current cumulative PTF level against the advisory's required fix level.
Audit user profiles with access to the integrated file system and remove unnecessary authorities.

Patch Information

IBM has published fixes referenced in the advisory at the IBM Support Page. Administrators should apply the group PTFs that correspond to each affected release of IBM i.

Workarounds

Restrict interactive and remote shell access to the IBM i system to trusted administrators only.
Tighten object-level authorities on sensitive directories using CHGAUT so that even boundary bypass yields no readable content.
Enable detailed object auditing on directories containing sensitive data until patches are installed.

bash

# Example: enable object auditing on a sensitive directory on IBM i
CHGAUD OBJ('/sensitive/data') OBJAUD(*ALL)
CHGAUT OBJ('/sensitive/data') USER(*PUBLIC) DTAAUT(*EXCLUDE) OBJAUT(*NONE)