CVE-2026-17274: IBM i Authentication Bypass Vulnerability

CVE-2026-17274 Overview

CVE-2026-17274 affects IBM i versions 7.3, 7.4, 7.5, and 7.6. The vulnerability allows a remote authenticated attacker to bypass security restrictions due to predictable server seeds generated by the operating system. The weakness maps to [CWE-330: Use of Insufficiently Random Values]. Because server seeds drive cryptographic operations during authentication and session negotiation, predictability weakens the confidentiality and integrity guarantees these protocols are designed to provide.

Critical Impact
An authenticated remote attacker can predict server-generated seed values, undermining cryptographic protections and enabling bypass of intended security restrictions on IBM i systems.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-09-04 - CVE-2026-17274 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-17274

Vulnerability Analysis

The vulnerability resides in the seed-generation logic used by IBM i during authenticated network exchanges. Server seeds are intended to be unpredictable random values that participate in cryptographic protocols such as password verification and challenge-response authentication. When these seeds are predictable, an attacker with a valid low-privilege account can anticipate the values a server will produce.

An attacker who guesses or reproduces the seed can influence downstream cryptographic operations. This weakens challenge-response schemes and creates conditions where security controls that assume unique, unpredictable seeds no longer hold. The result is bypass of restrictions that depend on that randomness.

The issue affects all currently supported IBM i releases from 7.3 through 7.6. Because the flaw is authenticated and network-reachable, it is most relevant in shared or multi-tenant IBM i environments where lower-privileged accounts interact with services that rely on server seeds.

Root Cause

The root cause is insufficient entropy in the routine that generates server-side seed values [CWE-330]. Rather than sourcing seeds from a cryptographically strong random number generator, the affected code paths produce values that can be predicted by an observer with sufficient context. This violates the core cryptographic requirement that seeds be unguessable.

Attack Vector

Exploitation requires network access and valid credentials on the target IBM i system. An attacker uses their authenticated session to interact with services that expose server seeds, then predicts subsequent seed values. Predicted seeds allow the attacker to bypass security restrictions that rely on the assumed randomness of those values. No user interaction is required beyond the attacker's own actions.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-17274

Indicators of Compromise

Repeated authenticated connections from a single user account probing services that negotiate server seeds during authentication.
Anomalous patterns of failed and successful authentications originating from the same source within short time windows.
Unexpected access to resources or objects that a user's authority level should not permit.

Detection Strategies

Enable and review IBM i audit journal (QAUDJRN) entries for authentication events, authority failures, and object access anomalies.
Correlate authentication traffic against baseline behavior for each user account to identify seed-probing activity.
Alert on privilege changes or successful access to sensitive libraries by accounts that historically lack such access.

Monitoring Recommendations

Forward IBM i security audit journals to a centralized SIEM for cross-correlation with network telemetry.
Monitor for concurrent sessions from the same user across multiple interfaces or IP addresses.
Track unusual volumes of authentication attempts against network services such as Host Servers and DDM/DRDA.

How to Mitigate CVE-2026-17274

Immediate Actions Required

Apply the IBM-supplied PTFs referenced on the IBM Support Page for all affected releases (7.3, 7.4, 7.5, 7.6).
Inventory IBM i systems and confirm which releases and cumulative PTF levels are deployed.
Rotate credentials for accounts that authenticate to IBM i systems, particularly service accounts with elevated authority.

Patch Information

IBM has published remediation guidance and PTFs through its support portal. Consult the IBM Support Page for the specific PTF identifiers that apply to each affected IBM i release and install them via standard PTF management procedures.

Workarounds

Restrict network access to IBM i host services to trusted management networks using firewall rules or exit programs.
Enforce the principle of least privilege so that authenticated users hold only the authority strictly required for their role.
Require strong, unique passwords and enable password composition rules under system value QPWDRULES to raise the cost of credential compromise that would enable exploitation.

bash

# Review current password rules on IBM i
DSPSYSVAL SYSVAL(QPWDRULES)

# Display applied PTFs to confirm patch installation
DSPPTF LICPGM(5770SS1)