CVE-2026-17484: IBM i Denial of Service Vulnerability

CVE-2026-17484 Overview

CVE-2026-17484 affects IBM i versions 7.3, 7.4, 7.5, and 7.6. The vulnerability allows a local authenticated attacker to trigger a denial of service through improper access control. IBM assigned this issue a medium severity rating based on its local attack vector and availability-only impact.

The weakness is categorized under CWE-200 and does not expose confidentiality or integrity of system data. Successful exploitation disrupts service availability on the affected IBM i host. IBM has published guidance through its support portal, and administrators should review the advisory to confirm applicable PTF levels.

Critical Impact
A local authenticated user can cause a high-impact denial of service against IBM i 7.3 through 7.6, disrupting workloads running on the affected system.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-10-13 - CVE-2026-17484 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-17484

Vulnerability Analysis

The vulnerability stems from improper access control within IBM i. A local attacker who already holds valid credentials on the system can invoke an affected interface that lacks sufficient authorization checks. The resulting condition degrades or halts system availability without granting any additional data access.

The issue impacts the base operating system across four supported IBM i releases. Because the attack vector is local and requires low privileges, the exposure is largely limited to users with existing shell, 5250, or API access. Workloads consolidated on a single partition face the greatest operational impact when the condition is triggered.

IBM categorizes the weakness under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, though the practical impact described by the vendor is availability loss rather than data disclosure. Administrators should treat the issue primarily as a denial of service risk against hosted applications and services.

Root Cause

IBM's advisory attributes the flaw to improper access control. An operation that should be restricted to privileged subjects is reachable by lower-privileged local users. Invocation of that operation produces a condition that exhausts or disrupts a required resource.

Attack Vector

Exploitation requires local access and low privileges, with no user interaction. The attacker executes the affected operation from an interactive session or program running on the IBM i partition. There is no network-exposed path, which limits exposure to users and services already authenticated to the host.

No public proof-of-concept, exploit kit, or in-the-wild activity has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS score indicates a low near-term probability of exploitation. The vulnerability mechanism is described in the IBM Support advisory; refer to that page for implementation-specific details.

Detection Methods for CVE-2026-17484

Indicators of Compromise

Unexpected termination or restart of IBM i subsystems, jobs, or services on partitions running 7.3, 7.4, 7.5, or 7.6.
Repeated QHST or QSYSOPR message queue entries indicating resource exhaustion or abnormal job endings.
Local user sessions invoking unusual commands or APIs shortly before a service availability event.

Detection Strategies

Audit QAUDJRN journal entries for command (CD), authority failure (AF), and system value (SV) event types from non-administrative users.
Correlate interactive 5250 session activity and SSH logins with system availability incidents using centralized log aggregation.
Baseline normal subsystem and job behavior, then alert when deviations align with low-privileged user activity.

Monitoring Recommendations

Forward IBM i audit journal data (QAUDJRN) and QSYSOPR messages to a SIEM for continuous review.
Monitor availability metrics for critical subsystems such as QINTER, QBATCH, and QSERVER.
Alert on repeated job failures or abnormal end codes originating from the same user profile within short time windows.

How to Mitigate CVE-2026-17484

Immediate Actions Required

Review the IBM Support advisory for CVE-2026-17484 and identify applicable PTFs for your IBM i release.
Apply the vendor-provided fixes to IBM i 7.3, 7.4, 7.5, and 7.6 partitions during the next available maintenance window.
Inventory user profiles with interactive or program-call access and remove unnecessary accounts.

Patch Information

IBM has published remediation guidance on its support portal. Consult the IBM Support page for the PTF numbers that correspond to your installed release and cumulative level. Apply the relevant group PTF or individual fix following standard IBM i change management procedures.

Workarounds

Restrict interactive and program-call access on affected partitions to trusted administrators until patches are applied.
Enforce least-privilege user profiles and remove *ALLOBJ or elevated special authorities from accounts that do not require them.
Enable or expand QAUDJRN auditing to capture authority failures and command execution by local users.

bash

# Example: enable auditing and review authority failures on IBM i
CHGSYSVAL SYSVAL(QAUDCTL) VALUE('*AUDLVL *OBJAUD')
CHGSYSVAL SYSVAL(QAUDLVL) VALUE('*AUTFAIL *SECURITY *SERVICE')
DSPJRN JRN(QAUDJRN) JRNCDE((T)) ENTTYP(AF)