CVE-2026-17262: IBM i FTP Authentication DOS Vulnerability

CVE-2026-17262 Overview

CVE-2026-17262 affects IBM i versions 7.6, 7.5, 7.4, and 7.3. The vulnerability allows a local attacker on an adjacent network to trigger a denial of service condition. The root cause is improper validation of File Transfer Protocol (FTP) authentication commands within the IBM i operating system.

An attacker with adjacent network access can send malformed FTP authentication commands to disrupt service availability. The flaw is tracked under CWE-78, improper neutralization of special elements used in an operating system command.

Critical Impact
Adjacent network attackers can degrade FTP service availability and integrity on IBM i systems across four supported major versions without authentication.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-09-18 - CVE CVE-2026-17262 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-17262

Vulnerability Analysis

The vulnerability resides in the FTP service component shipped with IBM i. The service processes authentication commands without applying sufficient input validation. Attackers can submit crafted authentication requests that the server fails to handle safely.

Successful exploitation causes a denial of service condition affecting the FTP subsystem. The CWE-78 mapping indicates that special elements passed inside FTP authentication commands are not properly neutralized before reaching downstream processing. This weakness class typically enables command handling to deviate from expected behavior, producing service disruption in this case.

The attack requires network adjacency rather than remote internet access. No prior authentication or user interaction is required to trigger the condition. Impact is limited to partial confidentiality preservation, with low impact to integrity and availability of the affected FTP service.

Root Cause

The FTP server component in IBM i does not properly validate authentication command input. Improper neutralization of special elements within these commands allows attacker-controlled data to influence command processing paths that were not designed to handle it.

Attack Vector

An attacker positioned on an adjacent network sends malformed FTP authentication commands to the target IBM i host. The FTP service processes the input without the validation required to reject or safely handle the malformed data. This results in denial of service against the FTP component. Refer to the IBM Support Article for vendor-provided technical details.

No verified proof-of-concept code is publicly available for this vulnerability at the time of writing.

Detection Methods for CVE-2026-17262

Indicators of Compromise

Unexpected termination or restart of the IBM i FTP server job (QTFTPnnnnn) without administrator action.
Malformed or oversized FTP authentication commands (USER, PASS, ACCT) originating from adjacent network segments.
Repeated FTP connection resets or authentication failures from a single source in a short time window.

Detection Strategies

Enable FTP exit point logging on QIBM_QTMF_SERVER_REQ and QIBM_QTMF_SVR_LOGON to capture command-level activity for the FTP service.
Forward IBM i history log (QHST) and job log entries related to FTP subsystem crashes into a centralized SIEM for correlation.
Deploy network-based inspection to alert on FTP authentication commands containing non-printable characters or unusual length.

Monitoring Recommendations

Monitor availability of the FTP server job and alert on unexpected end-of-job events.
Track FTP session counts and authentication failure rates per source IP for anomaly baselines.
Review QAUDJRN audit journal entries for network service disruption patterns.

How to Mitigate CVE-2026-17262

Immediate Actions Required

Apply the IBM-provided PTFs for IBM i 7.6, 7.5, 7.4, and 7.3 as documented in the IBM Support Article.
Restrict FTP service exposure to trusted network segments using IP filtering or firewall rules.
Disable the FTP server on systems where it is not operationally required using ENDTCPSVR SERVER(*FTP).

Patch Information

IBM has published remediation guidance in the referenced support document. Administrators should identify the applicable Program Temporary Fix (PTF) for each affected IBM i release and apply it through standard PTF installation procedures.

Workarounds

Limit FTP access at the network layer to authorized management hosts only.
Replace FTP with SSH-based alternatives such as SFTP where feasible to reduce attack surface.
Configure IBM i exit programs on FTP logon and server request exit points to reject malformed authentication commands.

bash

# End the FTP server on IBM i where FTP is not required
ENDTCPSVR SERVER(*FTP)

# Prevent automatic start of the FTP server at IPL
CHGFTPA AUTOSTART(*NO)