CVE-2026-17470: IBM i Buffer Overflow Vulnerability

CVE-2026-17470 Overview

CVE-2026-17470 is a buffer overflow vulnerability in IBM i that allows a remote, unauthenticated attacker to cause a denial of service. The flaw affects IBM i versions 7.3, 7.4, 7.5, and 7.6. IBM has published a security advisory describing the issue and providing remediation guidance.

The vulnerability is classified under [CWE-787] Out-of-Bounds Write. Exploitation requires no user interaction and no privileges, and can be triggered over the network. Successful exploitation results in high availability impact without affecting confidentiality or integrity.

Critical Impact
A remote, unauthenticated attacker can trigger a buffer overflow in IBM i to crash the affected system or service, disrupting business operations on the IBM Power platform.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-09-04 - CVE-2026-17470 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-17470

Vulnerability Analysis

CVE-2026-17470 is an out-of-bounds write ([CWE-787]) in IBM i that manifests as a buffer overflow. The overflow condition is reachable across the network without authentication, which broadens the pool of potential attackers to anyone with connectivity to an exposed service on the host.

The impact is limited to availability. IBM's advisory identifies denial of service as the outcome, meaning the affected service or system terminates or becomes unresponsive when the malformed input is processed. Confidentiality and integrity are not affected, and there is no indication of code execution associated with this specific CVE.

IBM i runs on IBM Power systems and often hosts core business workloads such as ERP, database, and transaction processing. A crash on these hosts can interrupt production applications and downstream integrations until the service is recovered.

Root Cause

The root cause is an out-of-bounds write in an IBM i component that fails to validate the length or bounds of network-supplied input before writing it into a fixed-size buffer. When the input exceeds the expected size, memory adjacent to the target buffer is corrupted, leading to a service crash. IBM's advisory is the authoritative reference for the affected component and fix details.

Attack Vector

The attack vector is network-based. An unauthenticated remote attacker sends a crafted request to an affected IBM i service, triggering the boundary violation and causing the service or system to terminate. No user interaction is required. Refer to the IBM Security Advisory for the specific affected component and protocol details.

No public proof-of-concept or exploit code is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.392%.

Detection Methods for CVE-2026-17470

Indicators of Compromise

Unexpected termination or restart of IBM i subsystems or network-facing services on affected hosts.
Job logs, QSYSOPR messages, or system operator messages showing abnormal ends (MCH-type exceptions) tied to network request handling.
Repeated malformed or oversized inbound requests to IBM i services from a single or small set of source IPs preceding a service crash.

Detection Strategies

Monitor IBM i history logs (DSPLOG) and job logs for abnormal service terminations correlated with inbound network traffic.
Deploy network-layer inspection to flag oversized or malformed protocol messages targeting IBM i hosts.
Correlate service crashes across multiple IBM i systems that share network exposure to identify targeted scanning or exploitation attempts.

Monitoring Recommendations

Establish availability baselines for critical IBM i services and alert on unplanned restarts or downtime.
Forward IBM i audit journals (QAUDJRN) and system operator messages to a central SIEM for correlation with network telemetry.
Track connection attempts to IBM i services from untrusted networks and alert on anomalous request sizes or connection rates.

How to Mitigate CVE-2026-17470

Immediate Actions Required

Inventory all IBM i systems running versions 7.3, 7.4, 7.5, or 7.6 and prioritize internet-exposed or DMZ-hosted instances.
Apply the fixes described in the IBM Security Advisory as soon as change windows allow.
Restrict network access to affected IBM i services using firewalls or network segmentation until patches are deployed.

Patch Information

IBM has published remediation guidance in its security advisory covering IBM i 7.3, 7.4, 7.5, and 7.6. Administrators should review the IBM Security Advisory for the specific PTFs (Program Temporary Fixes) applicable to each release and apply them following IBM's documented procedures.

Workarounds

Limit inbound access to affected IBM i services to trusted management networks using host or perimeter firewalls.
Disable affected services on IBM i hosts where they are not required for business operations.
Monitor for repeated abnormal service terminations and be prepared to isolate targeted systems while patches are staged.

bash

# Example: restrict access to an IBM i service to trusted subnets using an upstream firewall
# (adapt to your firewall platform; replace placeholders with your environment values)
iptables -A INPUT -p tcp --dport <ibm_i_service_port> -s <trusted_admin_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport <ibm_i_service_port> -j DROP