CVE-2026-17082: IBM i Privilege Escalation Vulnerability

CVE-2026-17082 Overview

CVE-2026-17082 is a privilege escalation vulnerability affecting IBM i versions 7.6, 7.5, 7.4, and 7.3. The flaw allows a remote authenticated attacker to gain elevated privileges through improper validation of a client-supplied profile name. The weakness is categorized under [CWE-269] Improper Privilege Management. Because IBM i systems commonly host business-critical workloads and sensitive data, successful exploitation can compromise confidentiality, integrity, and availability of the affected environment. See the IBM Support Document for the vendor advisory.

Critical Impact
An authenticated attacker with low privileges can escalate to elevated privileges on IBM i and gain full control over affected system resources.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-08-12 - CVE CVE-2026-17082 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-17082

Vulnerability Analysis

The vulnerability resides in an IBM i component that accepts a profile name from the client without properly validating it against the authenticated user's authorization context. When the server processes the client-supplied profile name, it associates subsequent operations with the specified profile rather than the caller's actual identity. This mismatch permits an authenticated attacker to execute actions under a profile with higher privileges than they were granted.

The root weakness maps to [CWE-269] Improper Privilege Management, in which a component assigns, modifies, or tracks privileges incorrectly. In this case, the trust placed in the client-supplied profile name allows an attacker to circumvent the normal privilege boundary between user profiles on IBM i.

Root Cause

IBM i profiles define user identity, group membership, and special authorities such as *ALLOBJ, *SECADM, and *SERVICE. The affected component trusts the profile name provided by the client rather than deriving it from the authenticated session. Without server-side validation that the caller is authorized to act as the supplied profile, the code path grants access based on the impersonated profile's authorities.

Attack Vector

Exploitation requires network access and valid credentials to the target IBM i system. The attacker authenticates with a low-privileged account, then submits a request that includes the profile name of a higher-privileged user. The server honors the supplied profile and executes the requested operation with elevated authority. No user interaction is required, and the attack complexity is low. Refer to the IBM Support Document for vendor-provided technical details and fix availability.

Detection Methods for CVE-2026-17082

Indicators of Compromise

Unexpected use of privileged profiles such as QSECOFR or profiles holding *ALLOBJ and *SECADM special authorities from sessions initiated by low-privileged users.
Audit journal QAUDJRN entries showing profile switches or object access that do not correlate with the authenticated session's origin.
Job log entries referencing a profile name that differs from the signed-on user for the same network connection.

Detection Strategies

Enable IBM i security auditing with QAUDLVL values that include *AUTFAIL, *SECURITY, and *PGMADP to capture authorization failures and adopted-authority events.
Correlate authentication events with subsequent privileged operations to identify sessions whose executed actions exceed the signed-on user's granted authorities.
Baseline normal profile usage per host application and alert on deviations, particularly requests that specify a profile name distinct from the authenticated identity.

Monitoring Recommendations

Forward QAUDJRN audit journal entries to a centralized log platform for retention and cross-source correlation.
Monitor host servers and exit points for anomalous client-supplied parameters, especially profile names referencing administrative accounts.
Alert on creation, modification, or unexpected use of profiles carrying special authorities across managed IBM i partitions.

How to Mitigate CVE-2026-17082

Immediate Actions Required

Apply the IBM-provided PTFs referenced in the IBM Support Document to all affected IBM i 7.3, 7.4, 7.5, and 7.6 systems.
Inventory user profiles with special authorities and reduce entitlement where operationally feasible to limit the blast radius of privilege escalation.
Rotate credentials for privileged profiles and review recent audit journal activity for signs of misuse.

Patch Information

IBM has published remediation guidance and PTF details for CVE-2026-17082 on the vendor support portal. Administrators should consult the IBM Support Document to identify the specific Program Temporary Fixes required for each affected release and install them through standard PTF management procedures.

Workarounds

Restrict network access to IBM i host servers and administrative services to trusted management networks until PTFs are applied.
Enforce object-level authority and remove unnecessary *ALLOBJ, *SECADM, *SERVICE, and *SPLCTL special authorities from non-administrative profiles.
Configure IBM i exit programs on the affected host server interfaces to inspect and reject requests that specify a profile name inconsistent with the authenticated session.

bash

# Configuration example: raise IBM i auditing to capture privilege-related events
CHGSYSVAL SYSVAL(QAUDCTL) VALUE('*AUDLVL *OBJAUD')
CHGSYSVAL SYSVAL(QAUDLVL) VALUE('*AUTFAIL *SECURITY *PGMADP *SERVICE')

# Review profiles that hold elevated special authorities
PRTUSRPRF TYPE(*AUTINFO) SELECT(*SPCAUT) SPCAUT(*ALLOBJ *SECADM *SERVICE *SPLCTL)