CVE-2026-17487: IBM i Information Disclosure Vulnerability

CVE-2026-17487 Overview

CVE-2026-17487 is an information disclosure vulnerability in IBM i that allows unauthenticated remote attackers to enumerate valid user profiles. The flaw stems from the sign-on process returning distinct error codes depending on whether the supplied user profile exists. An attacker can submit authentication attempts and distinguish valid accounts from invalid ones by inspecting the server response. This weakness is categorized as information exposure [CWE-200] and affects multiple supported releases of the IBM i operating system.

Critical Impact
Remote, unauthenticated attackers can harvest valid IBM i user profile names to seed targeted password spraying, brute-force, and social engineering campaigns against enterprise midrange systems.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5 and 7.6

Discovery Timeline

2026-10-13 - CVE-2026-17487 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-17487

Vulnerability Analysis

The IBM i sign-on handler returns different error codes based on whether the submitted user profile exists on the system. An invalid user profile produces a different response than a valid profile with an incorrect password. Attackers can script authentication attempts across a candidate username list and classify each response. Valid profiles are then compiled into a target list for follow-on credential attacks.

The vulnerability is a classic authentication oracle. It does not expose passwords or account contents directly, but it eliminates the guesswork from account discovery. On IBM i systems, valid profile names often correspond to privileged roles such as QSECOFR, service accounts, or application-specific identities, which increases the value of enumeration to an attacker.

Root Cause

The sign-on routine fails to normalize authentication failure responses. Instead of returning a single generic error for any invalid credential pair, the subsystem differentiates between "user profile not found" and "password incorrect" conditions. This design violates the principle that authentication errors should be indistinguishable to unauthenticated callers.

Attack Vector

The attack requires only network access to an IBM i sign-on service and no prior credentials or user interaction. An attacker iterates through candidate user profile names using any client that exercises the IBM i authentication path, including 5250 Telnet sessions, Host Servers used by IBM i Access clients, and ODBC or JDBC connectors. Response codes are parsed to separate valid profiles from invalid ones. No code execution occurs on the target during enumeration, which makes the activity difficult to distinguish from legitimate failed logons without correlation.

No public proof-of-concept exploit is listed for CVE-2026-17487. See the IBM security bulletin for vendor-specific technical details.

Detection Methods for CVE-2026-17487

Indicators of Compromise

High volumes of failed sign-on attempts from a single source address, especially spanning many distinct user profile names in a short interval.
Authentication failures distributed across Host Servers, Telnet, ODBC, or DRDA services from non-business IP ranges.
Repeated probes against well-known IBM i profiles such as QSECOFR, QUSER, QSYSOPR, or QPGMR from external sources.

Detection Strategies

Enable and monitor the IBM i audit journal QAUDJRN with *AUTFAIL auditing to capture sign-on failures with user profile and job context.
Correlate failed sign-on events across subsystems to identify enumeration patterns where many unique usernames are tested with few or no password retries per account.
Alert on anomalous ratios of "user not found" versus "invalid password" results originating from the same source.

Monitoring Recommendations

Forward IBM i security journal events into a centralized SIEM or data lake for cross-system correlation and long-term baselining.
Baseline normal sign-on failure rates per source IP and per service, then alert on deviations consistent with scripted enumeration.
Track and review Host Server and Telnet connections from untrusted networks, and investigate sources that generate failures against profiles that have never logged in before.

How to Mitigate CVE-2026-17487

Immediate Actions Required

Apply the IBM-provided fix referenced in the IBM support advisory to all affected IBM i 7.3, 7.4, 7.5, and 7.6 systems.
Restrict network reachability of IBM i sign-on services (Telnet, Host Servers, ODBC) to trusted management networks using exit programs, firewalls, or IBM i Access Client Solutions configuration.
Enforce account lockout via the QMAXSIGN and QMAXSGNACN system values to limit the rate at which an attacker can test profile names.

Patch Information

IBM has published remediation guidance in the vendor advisory at IBM Support node 7290096. Administrators should review the bulletin for the specific PTF (Program Temporary Fix) numbers that apply to each IBM i release level and install them through standard PTF management procedures.

Workarounds

Deploy IBM i exit programs on sign-on and Host Server points to normalize or suppress responses to repeated failed authentication attempts from a single source.
Place IBM i sign-on services behind a VPN or jump host so that unauthenticated internet-based enumeration is not possible.
Rename or disable high-value default profiles where supported, and ensure dormant profiles are set to STATUS(*DISABLED) to reduce the enumeration target set.

bash

# Example IBM i system value hardening to limit sign-on abuse
CHGSYSVAL SYSVAL(QMAXSIGN)   VALUE('3')
CHGSYSVAL SYSVAL(QMAXSGNACN) VALUE('3')
CHGSYSVAL SYSVAL(QAUDLVL)    VALUE('*AUTFAIL *SECURITY')