CVE-2026-17445: IBM i Authentication Bypass Vulnerability

CVE-2026-17445 Overview

CVE-2026-17445 affects IBM i versions 7.6, 7.5, 7.4, and 7.3. A remote authenticated attacker can bypass security restrictions by supplying a crafted user profile name. The root cause is improper validation of an attacker-supplied user profile name, categorized under [CWE-250] Execution with Unnecessary Privileges. The flaw permits access to resources or actions beyond the attacker's intended permission level.

Critical Impact
An authenticated remote attacker can bypass security restrictions on IBM i systems, leading to unauthorized read access to sensitive data and limited integrity impact across affected releases.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-08-12 - CVE CVE-2026-17445 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-17445

Vulnerability Analysis

The vulnerability resides in how IBM i validates user profile names supplied by authenticated callers. When an attacker submits a crafted profile name, the operating system fails to enforce the intended security boundary. This lets the caller execute operations under privileges that should not be available to the caller's account.

The issue affects all currently supported IBM i releases: 7.3, 7.4, 7.5, and 7.6. Because IBM i user profiles govern object authority, adopted authority, and job execution context, mishandling of profile names can escalate what an authenticated session may access. The confidentiality impact is high while integrity is limited and availability is not affected.

Root Cause

The vulnerability maps to [CWE-250] Execution with Unnecessary Privileges. IBM i accepts a user profile name from an attacker-controlled input path without adequately validating whether the requesting session should be permitted to reference or act as that profile. The validation gap allows the request to proceed with elevated context.

Attack Vector

Exploitation requires network access and prior authentication to the target IBM i partition. No user interaction is required. The attacker submits a malformed or otherwise attacker-chosen user profile name to a component that trusts the supplied value. The successful request returns data or performs operations the caller should not be authorized to reach.

No public proof-of-concept has been published. See the IBM Support Resource for vendor technical details.

Detection Methods for CVE-2026-17445

Indicators of Compromise

Audit journal (QAUDJRN) entries showing unexpected profile name references from user sessions that should not possess such authority.
Unusual *USRPRF object references in application logs originating from low-privilege authenticated accounts.
Access to sensitive libraries or objects from job sessions whose baseline profile lacks the required authority.

Detection Strategies

Enable and review IBM i security auditing with QAUDLVL values covering *AUTFAIL, *SECURITY, and *OBJMGT to capture profile-related anomalies.
Correlate authentication events with subsequent object access requests to identify sessions performing actions inconsistent with the authenticated user's authority.
Baseline expected user profile usage per application and alert on deviations, especially requests that reference privileged profiles such as QSECOFR or service accounts.

Monitoring Recommendations

Forward IBM i audit journal data to a centralized SIEM for correlation with identity and network telemetry.
Monitor for repeated failed profile validation attempts followed by successful access, which may indicate exploitation attempts.
Track privileged profile usage patterns and alert on off-hours or non-standard host activity.

How to Mitigate CVE-2026-17445

Immediate Actions Required

Apply the IBM-provided PTFs referenced in the IBM Support Resource for IBM i 7.3, 7.4, 7.5, and 7.6.
Inventory all IBM i partitions and confirm current release and cumulative PTF level.
Restrict network access to IBM i services so only trusted management hosts can authenticate.

Patch Information

IBM has published guidance for CVE-2026-17445 in the IBM Support Resource. Administrators should review the advisory and apply the required Program Temporary Fixes for each affected IBM i release. Because the vulnerability requires authentication, patching should be paired with a review of user profile authorities.

Workarounds

Review and reduce authority granted to interactive and application user profiles, applying least privilege to limit exploit impact.
Restrict use of adopted authority (USRPRF(*OWNER)) on programs that accept user-supplied profile names.
Limit network exposure of IBM i host services (for example, database and remote command interfaces) to trusted subnets until PTFs are applied.

bash

# Example: display current PTF group status and audit configuration on IBM i
DSPPTF LICPGM(5770SS1)
WRKPTFGRP
DSPSYSVAL SYSVAL(QAUDLVL)
CHGSYSVAL SYSVAL(QAUDCTL) VALUE('*AUDLVL *OBJAUD')