CVE-2026-17499: IBM i Command Injection RCE Vulnerability

CVE-2026-17499 Overview

IBM i versions 7.3, 7.4, 7.5, and 7.6 contain an OS command injection vulnerability [CWE-78] that allows a local attacker to execute arbitrary commands. The flaw stems from improper neutralization of special elements passed to an operating system command. A successful attacker gains high impact against confidentiality, integrity, and availability on the affected system. IBM has published a support advisory documenting the affected releases and remediation guidance.

Critical Impact
A local, authenticated attacker on IBM i can inject operating system commands to escalate privileges and take full control of the host.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-09-04 - CVE-2026-17499 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-17499

Vulnerability Analysis

The vulnerability is an OS command injection weakness classified under [CWE-78]. IBM i constructs an operating system command using input that is not properly neutralized. An attacker with local access and low privileges can supply crafted input containing shell metacharacters or command separators. The IBM i runtime passes this input into a command interpreter, which then executes attacker-controlled commands in the context of the calling process.

Because exploitation requires local access and low-privilege authentication but no user interaction, the vulnerability aligns with post-access privilege escalation and lateral movement scenarios. Successful exploitation grants execution with the privileges of the vulnerable component, which on IBM i can include elevated system authorities.

Root Cause

The root cause is missing or incomplete sanitization of special characters, such as command separators and shell metacharacters, before those characters are embedded in an operating system command string. IBM's advisory identifies the affected component and provides fix availability. Refer to the IBM Support Document for the specific component and PTF details.

Attack Vector

An attacker requires an authenticated local session on the IBM i system. The attacker invokes the affected functionality with crafted input containing embedded OS commands. The vulnerable code path concatenates this input into a command string and passes it to the system for execution. No user interaction is required, and the attack scope remains unchanged, meaning execution occurs within the same security context as the vulnerable process.

No public proof-of-concept exploit code is available at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-17499

Indicators of Compromise

Unexpected QSH, QP2SHELL, or QP2TERM shell invocations spawned by IBM i application jobs or service programs.
Job logs (DSPJOBLOG) showing command strings containing shell metacharacters such as ;, |, `, or $( in parameter values.
New or unexplained user profiles, authority changes (CHGUSRPRF), or object ownership changes following suspicious job activity.

Detection Strategies

Monitor IBM i audit journal (QAUDJRN) entries of type CD (command string) and PW (invalid password) for anomalous command patterns and repeated privilege probing.
Alert on process ancestry where interactive shells (QSHELL, PASE) are launched by service jobs, HTTP server instances, or batch subsystems that do not normally invoke them.
Correlate authenticated local sessions with subsequent authority elevation events (*ALLOBJ, *SECADM) recorded in QAUDJRN.

Monitoring Recommendations

Forward IBM i security audit journal events to a centralized SIEM for long-term retention and cross-source correlation.
Baseline normal command execution patterns per user profile and application, then alert on deviations involving shell escape characters.
Review privileged profile activity daily, focusing on profiles with *ALLOBJ, *SECADM, or *JOBCTL special authorities.

How to Mitigate CVE-2026-17499

Immediate Actions Required

Apply the IBM-provided PTFs referenced in the IBM Support Document for IBM i 7.3, 7.4, 7.5, and 7.6.
Inventory local user profiles and reduce the number of accounts with interactive sign-on and elevated special authorities.
Review and restrict access to the affected component identified in the IBM advisory until PTFs are applied.

Patch Information

IBM has released fixes as documented in the vendor advisory. Administrators should download and apply the applicable PTF group for their IBM i release using standard change-control procedures. Verify PTF installation with DSPPTF and confirm the fix level matches IBM's guidance before returning affected systems to production use.

Workarounds

Remove *USE authority to the vulnerable command or program object from *PUBLIC and grant it only to required service accounts.
Enable command-line restrictions on user profiles by setting LMTCPB(*YES) for users who do not require ad-hoc command execution.
Increase audit journal coverage by enabling QAUDCTL(*AUDLVL) with QAUDLVL values that include *CMD and *SECURITY to capture exploitation attempts.

bash

# Configuration example
# Restrict command line capability for standard users
CHGUSRPRF USRPRF(APPUSER) LMTCPB(*YES)

# Enable command auditing in the security audit journal
CHGSYSVAL SYSVAL(QAUDCTL) VALUE('*AUDLVL *OBJAUD')
CHGSYSVAL SYSVAL(QAUDLVL) VALUE('*CMD *SECURITY *AUTFAIL')

# Verify installed PTFs after applying IBM fix
DSPPTF LICPGM(5770SS1)