CVE-2026-17095: IBM i Auth Bypass Vulnerability

CVE-2026-17095 Overview

CVE-2026-17095 is an unsafe reflection vulnerability affecting IBM i versions 7.6, 7.5, 7.4, and 7.3. A remote authenticated attacker can bypass security restrictions by abusing reflection mechanisms that load classes or invoke methods without proper validation. The flaw is tracked under CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes. Successful exploitation impacts confidentiality and integrity while producing limited availability effects.

Critical Impact
Authenticated attackers on the network can bypass IBM i security controls, gaining the ability to modify object attributes and influence privileged operations across the affected system.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-08-12 - CVE CVE-2026-17095 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-17095

Vulnerability Analysis

The vulnerability stems from unsafe reflection in IBM i components. Reflection allows code to inspect and invoke classes, fields, and methods dynamically at runtime. When user-influenced input feeds into reflective calls without allowlisting or validation, an attacker can direct the runtime to load or invoke unintended targets.

In IBM i, this behavior can be leveraged by an authenticated remote user to bypass security restrictions and reach code paths that were not intended to be exposed. Because the underlying weakness is CWE-915, the attacker can influence object attributes that were expected to remain internal or read-only.

The result is high impact to confidentiality and integrity, with lower impact to availability. Exploitation requires low privileges and no user interaction, and the attack traverses the network.

Root Cause

The root cause is improper control over dynamically-determined object attributes reached through reflection. Class or method identifiers derived from attacker-controlled input are dispatched without a strict allowlist. IBM's advisory describes the flaw as unsafe reflection permitting a security bypass. See the IBM Support advisory for vendor-specific technical details.

Attack Vector

An attacker authenticates to an IBM i service reachable over the network. The attacker then submits crafted input that steers a reflective call toward a class or method outside the intended scope. This bypasses server-side checks that assume the call target is fixed, granting access to protected operations. No verified public exploit code or proof of concept is available at the time of publication.

Detection Methods for CVE-2026-17095

Indicators of Compromise

Unexpected invocations of privileged system or Java classes originating from user-facing services on IBM i.
Authentication events from low-privilege accounts followed by activity typically associated with administrative roles.
Application or job log entries showing reflective class loading with attacker-influenced parameters.

Detection Strategies

Review IBM i audit journal (QAUDJRN) entries for anomalous object access and authority changes tied to authenticated sessions.
Correlate application-layer request logs with subsequent privileged operations to identify reflection-driven bypasses.
Baseline normal reflective usage patterns in IBM i Java-based workloads and alert on deviations.

Monitoring Recommendations

Forward IBM i audit journals and application logs to a centralized analytics platform for long-term retention and correlation.
Monitor authenticated sessions for privilege boundary violations and access to sensitive libraries.
Track authentication anomalies such as unusual source addresses or off-hours logins against IBM i services.

How to Mitigate CVE-2026-17095

Immediate Actions Required

Apply the IBM-supplied fixes referenced in the IBM Support advisory for IBM i 7.6, 7.5, 7.4, and 7.3.
Restrict network reachability of IBM i services to trusted management networks and known application tiers.
Audit user profiles and remove excess authority from accounts that authenticate to exposed services.

Patch Information

IBM has published guidance and remediation details on the vendor support page. Administrators should follow the IBM Support advisory for node 7283292 to identify the correct PTF group and fix level for each affected IBM i release.

Workarounds

Enforce least-privilege authority on IBM i user profiles and disable unused accounts to reduce authenticated attack surface.
Place IBM i management interfaces behind network segmentation and require VPN or jump-host access.
Increase audit journal detail for object and authority events until PTFs are deployed.

bash

# Configuration example: enable IBM i security auditing for object and authority events
CHGSYSVAL SYSVAL(QAUDCTL) VALUE('*AUDLVL *OBJAUD')
CHGSYSVAL SYSVAL(QAUDLVL) VALUE('*AUTFAIL *SECURITY *PGMFAIL *OBJMGT')