CVE-2026-17110: IBM i Privilege Escalation Vulnerability

CVE-2026-17110 Overview

CVE-2026-17110 affects IBM i versions 7.6, 7.5, 7.4, and 7.3. The vulnerability allows a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privilege management [CWE-250]. An attacker with valid low-privilege credentials can leverage the flaw over the network to compromise confidentiality, integrity, and availability of the affected system.

Critical Impact
Authenticated remote attackers can execute arbitrary commands with elevated privileges and access sensitive data on affected IBM i systems.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-08-12 - CVE CVE-2026-17110 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-17110

Vulnerability Analysis

The vulnerability is classified under Execution with Unnecessary Privileges [CWE-250]. IBM i executes certain operations with more privileges than required to perform their function. A remote authenticated attacker can exploit this behavior to run arbitrary commands and read sensitive data outside the intended authorization boundary.

Because the attack vector is network-based and requires only low privileges without user interaction, the vulnerability is well suited to lateral movement scenarios. An attacker who obtains any valid user credential — through phishing, credential reuse, or a prior compromise — can pivot into command execution on IBM i hosts that traditionally underpin financial, ERP, and manufacturing workloads.

Root Cause

The root cause is improper privilege management within components of IBM i. Code paths available to authenticated users execute with privileges beyond what the calling user should hold. This design flaw permits authorized users to trigger operations that read protected data or invoke system commands as a higher-privileged context.

Attack Vector

Exploitation requires network access to the IBM i system and valid user credentials. No user interaction is needed. The attacker submits requests through an exposed interface that internally invokes over-privileged operations, achieving command execution and information disclosure. See the IBM Support Page for vendor-specific technical details.

No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2026-17110

Indicators of Compromise

Unexpected command invocations originating from user accounts that normally do not execute administrative operations on IBM i.
Anomalous access to sensitive libraries, files, or system data by low-privileged authenticated sessions.
New or unusual job submissions running under elevated authority in the IBM i job log.

Detection Strategies

Audit IBM i security journals (QAUDJRN) for entries indicating privilege elevation, command execution, and authority failures tied to standard user profiles.
Correlate authentication events with subsequent command execution activity to identify sessions performing actions outside their normal scope.
Monitor network-facing IBM i services (host servers, ODBC/JDBC, SSH) for command patterns consistent with post-authentication exploitation.

Monitoring Recommendations

Baseline normal command usage per user profile and alert on deviations, especially calls to system utilities and privileged APIs.
Forward IBM i audit journals to a centralized SIEM for long-term retention and cross-source correlation.
Track authority changes and adopted-authority program execution to catch abuse of over-privileged code paths.

How to Mitigate CVE-2026-17110

Immediate Actions Required

Apply the IBM-supplied fix referenced in the IBM Support Page for IBM i 7.6, 7.5, 7.4, and 7.3.
Review and reduce user profile special authorities, ensuring least privilege for all interactive and program-invoked accounts.
Rotate credentials for user profiles that may have been exposed, prioritizing accounts with network access to IBM i services.

Patch Information

IBM has published remediation guidance on the IBM Support Page. Administrators should apply the referenced PTFs for each supported release of IBM i (7.6, 7.5, 7.4, and 7.3) as soon as maintenance windows permit.

Workarounds

Restrict network access to IBM i host services so that only trusted management networks can reach exposed interfaces.
Enforce strong authentication and multi-factor authentication in front of any remote access paths to IBM i.
Disable or restrict adopted-authority programs and command-line access for user profiles that do not require them until patches are applied.

bash

# Configuration example
# Review and constrain user profile authorities on IBM i
DSPUSRPRF USRPRF(SUSPECT_USER) TYPE(*BASIC)
CHGUSRPRF USRPRF(SUSPECT_USER) SPCAUT(*NONE) LMTCPB(*YES)

# Ensure security auditing is enabled
CHGSYSVAL SYSVAL(QAUDCTL) VALUE('*AUDLVL *OBJAUD')
CHGSYSVAL SYSVAL(QAUDLVL) VALUE('*AUTFAIL *SECURITY *SERVICE *PGMADP')