CVE-2026-17094: IBM i Path Traversal Vulnerability

CVE-2026-17094 Overview

CVE-2026-17094 is a path traversal vulnerability [CWE-22] affecting IBM i versions 7.6, 7.5, 7.4, and 7.3. A remote authenticated attacker can leverage the flaw to read sensitive files and manipulate file contents outside the intended directory scope. The vulnerability requires low privileges and no user interaction, and it is exploitable over the network.

Critical Impact
An authenticated remote attacker can traverse directory boundaries on IBM i systems to disclose sensitive information and modify files outside the intended access scope.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-08-12 - CVE-2026-17094 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-17094

Vulnerability Analysis

The vulnerability is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory). IBM i does not correctly sanitize user-supplied path components before resolving them against the file system. An authenticated attacker can submit crafted path sequences containing traversal characters such as ../ to escape the intended directory. This allows access to files elsewhere on the integrated file system (IFS).

The impact is scoped to confidentiality of files the process account can read and integrity of files it can modify. Availability is not affected. Because authentication is required, exploitation depends on the attacker holding valid IBM i credentials, whether legitimately assigned or obtained through prior compromise.

Root Cause

The root cause is insufficient validation and canonicalization of file path inputs supplied to an affected IBM i service or interface. Path components are used to construct file system references without rejecting traversal sequences or enforcing a strict base-directory containment check. Technical specifics for the affected component are documented in the IBM Support Page.

Attack Vector

An authenticated remote user submits a request containing a manipulated file path parameter. By embedding directory traversal sequences, the attacker forces the server to resolve paths outside of the intended directory. The server then returns file contents to the attacker or writes attacker-controlled data to locations outside the sanctioned path. No user interaction is required beyond the attacker's own request.

A detailed exploitation sequence has not been published. Refer to the IBM Support Page for vendor-provided technical details.

Detection Methods for CVE-2026-17094

Indicators of Compromise

Requests to IBM i services containing path traversal sequences such as ../, ..\, or URL-encoded variants like %2e%2e%2f.
Unexpected file reads or writes performed by IBM i service accounts targeting paths outside standard application directories.
Audit journal (QAUDJRN) entries showing object access from user profiles that normally do not touch system or configuration files.

Detection Strategies

Enable and review IBM i security audit journaling (QAUDJRN) with the *AUTFAIL and *OBJMGT audit values to capture unauthorized file access attempts.
Inspect application and web-facing service logs on IBM i for parameters containing directory traversal patterns or encoded traversal payloads.
Correlate authenticated user activity with file system access outside expected application scope to surface anomalies.

Monitoring Recommendations

Forward IBM i audit journal data to a centralized SIEM for correlation with authentication events and network telemetry.
Alert on file access patterns where a single authenticated session reads a broad set of unrelated directories in a short window.
Track user profiles that suddenly interact with IFS paths such as /QSYS.LIB or configuration directories they have never previously accessed.

How to Mitigate CVE-2026-17094

Immediate Actions Required

Apply the fix documented on the IBM Support Page for IBM i 7.6, 7.5, 7.4, and 7.3.
Inventory IBM i systems in the environment and confirm the installed PTF level against IBM's guidance.
Review authority settings on sensitive IFS directories and reduce access for user profiles that do not require it.

Patch Information

IBM has published remediation guidance for affected IBM i releases. Consult the IBM Support Page for the specific Program Temporary Fix (PTF) identifiers applicable to each supported release (7.6, 7.5, 7.4, 7.3) and apply them following standard IBM i PTF procedures.

Workarounds

Restrict network access to IBM i services so that only trusted administrative networks can authenticate against them.
Enforce least-privilege authority on IFS objects and reduce *ALLOBJ and broad *PUBLIC authorities where practical.
Rotate credentials for user profiles that access affected services and audit for unnecessary or dormant profiles.

bash

# Example: review current audit settings on IBM i (run from CL command line)
DSPSYSVAL SYSVAL(QAUDCTL)
DSPSYSVAL SYSVAL(QAUDLVL)

# Enable object access and authority failure auditing
CHGSYSVAL SYSVAL(QAUDCTL) VALUE('*AUDLVL *OBJAUD')
CHGSYSVAL SYSVAL(QAUDLVL) VALUE('*AUTFAIL *OBJMGT')