CVE-2026-17273: IBM i DOS Vulnerability

CVE-2026-17273 Overview

CVE-2026-17273 affects IBM i versions 7.6, 7.5, 7.4, and 7.3. The vulnerability allows a remote authenticated attacker to trigger a NULL pointer dereference, resulting in a denial of service condition. The flaw is classified under [CWE-476] (NULL Pointer Dereference) and requires network access with low privileges to exploit. Successful exploitation impacts system availability without compromising confidentiality or integrity. IBM published a support advisory addressing the issue, and the vulnerability was added to the National Vulnerability Database on September 4, 2026.

Critical Impact
Authenticated remote attackers can cause a denial of service on affected IBM i systems, disrupting business-critical workloads on IBM Power servers.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-09-04 - CVE-2026-17273 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-17273

Vulnerability Analysis

CVE-2026-17273 is a NULL pointer dereference vulnerability in IBM i, the operating system running on IBM Power hardware. The flaw is reachable over the network by an attacker holding valid credentials. Triggering the dereference causes the affected process or service to terminate, producing a denial of service condition. Confidentiality and integrity are not directly impacted, but availability loss on IBM i systems can disrupt ERP, database, and transaction-processing workloads that depend on the platform.

Root Cause

The underlying weakness is [CWE-476], a NULL pointer dereference. The affected code path fails to validate that a pointer is non-null before dereferencing it. When a crafted request reaches the vulnerable component, the pointer is used without a preceding null check, causing a fault that terminates the service handling the request. IBM's advisory identifies the affected components and provides fixed PTF (Program Temporary Fix) levels for each supported release.

Attack Vector

Exploitation requires network access and a valid authenticated session against the target IBM i host. No user interaction is required. An attacker sends a malformed or unexpected input to the vulnerable service, which triggers the dereference and halts the affected process. Because privileges required are low, any authenticated user account, including low-privilege service accounts, can serve as the launch point. The EPSS score of 0.353% reflects low observed exploitation activity as of the publication date.

No public proof-of-concept code has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the IBM Support Page for component-specific technical details.

Detection Methods for CVE-2026-17273

Indicators of Compromise

Unexpected termination or restart of IBM i subsystem jobs or services following network requests from authenticated sessions.
System operator messages (QSYSOPR) indicating abnormal job end (MCH3601 or similar pointer-related exceptions).
Repeated connection attempts from a single authenticated user immediately preceding a service crash.

Detection Strategies

Monitor IBM i job logs and QHST history logs for abnormal terminations correlated with authenticated network activity.
Enable and review audit journal (QAUDJRN) entries for anomalous authentication and command execution patterns from non-administrative users.
Correlate service availability alerts with authentication events to identify attacker-triggered outages.

Monitoring Recommendations

Forward IBM i audit journal, QHST, and QSYSOPR message queues to a centralized SIEM for correlation and alerting.
Baseline normal service uptime and alert on unplanned restarts of TCP/IP servers and host servers.
Track authentication events for low-privilege accounts accessing network-facing IBM i services outside expected patterns.

How to Mitigate CVE-2026-17273

Immediate Actions Required

Apply the IBM-provided PTFs for IBM i 7.3, 7.4, 7.5, and 7.6 as documented in the IBM Support Page.
Inventory all IBM i systems and confirm current cumulative PTF levels against IBM's fix list.
Review and reduce the number of user accounts with network access to the affected services.

Patch Information

IBM has published remediation guidance and PTFs in advisory IBM Support Page. Administrators should download the applicable Group PTFs for each installed IBM i release and apply them following IBM's standard PTF installation procedures. Verify patch application using DSPPTF after installation.

Workarounds

Restrict network access to affected IBM i services using exit programs or network-layer access controls until PTFs are applied.
Enforce least-privilege user profiles and disable inactive accounts to reduce the pool of accounts capable of authenticating.
Segment IBM i hosts on management networks to limit exposure to untrusted authenticated users.

bash

# Verify installed PTFs on IBM i (run from a 5250 session)
DSPPTF LICPGM(5770SS1)

# List user profiles with network access; disable unused accounts
DSPUSRPRF USRPRF(*ALL) TYPE(*BASIC) OUTPUT(*PRINT)
CHGUSRPRF USRPRF(INACTIVE_USER) STATUS(*DISABLED)