CVE-2026-81858: IBM i File Server DOS Vulnerability

CVE-2026-81858 is a denial of service vulnerability in IBM i File Server affecting versions 7.3 through 7.6. Remote authenticated attackers can exploit an out-of-bounds read to crash services and leak data. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-81858 Overview

CVE-2026-81858 is an out-of-bounds read vulnerability in the IBM i File Server component. The flaw affects IBM i versions 7.3, 7.4, 7.5, and 7.6. A remote authenticated attacker can trigger the condition over the network to cause a denial of service and read memory contents outside intended bounds. The vulnerability is tracked as CWE-125: Out-of-bounds Read. IBM has published a security advisory describing affected releases and remediation guidance.

Critical Impact
An authenticated remote attacker can crash the IBM i File Server and extract adjacent memory contents, disrupting file-sharing services and exposing sensitive data processed by the service.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5 and 7.6

Discovery Timeline

2026-10-13 - CVE-2026-81858 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-81858

Vulnerability Analysis

The File Server component in IBM i processes network requests from authenticated users accessing shared files and directories. The vulnerability stems from an out-of-bounds read condition during request handling. When the server parses a crafted request, it reads memory beyond the intended buffer boundary. This behavior can crash the File Server process and leak adjacent memory contents to the attacker. The result is both a denial of service for file-sharing clients and unauthorized disclosure of information held in server memory.

Root Cause

The root cause is classified under CWE-125: Out-of-bounds Read. The File Server fails to validate the length or offset of a field within an incoming request before accessing memory. Without a bounds check, the read operation extends past the allocated buffer. IBM has not published low-level technical details of the affected parsing path. Refer to the IBM Security Advisory for authoritative component information.

Attack Vector

Exploitation requires network access to the IBM i File Server and valid authenticated credentials. Low privileges are sufficient; no user interaction is needed. An attacker sends a malformed request to the File Server to trigger the out-of-bounds read. Successful exploitation yields confidential memory content and can terminate the service. The current EPSS score is 0.482% at the 40th percentile, and no public proof-of-concept or in-the-wild exploitation is reported.

No verified exploit code is publicly available for CVE-2026-81858.
See the IBM Security Advisory for component-level technical details:
https://www.ibm.com/support/pages/node/7290195

Detection Methods for CVE-2026-81858

Indicators of Compromise

Unexpected termination or restart of the IBM i File Server job (QPWFSERVSO, QPWFSERVSD) following remote connections.
Authenticated sessions originating from unusual source addresses issuing malformed File Server requests.
Repeated connection attempts to File Server ports followed by service disruption events.

Detection Strategies

Monitor IBM i QSYSOPR and QHST message queues for File Server job failures and abnormal end messages.
Correlate authentication events with subsequent File Server crash events to identify credential abuse patterns.
Inspect network traffic to File Server ports for oversized or malformed PDU structures.

Monitoring Recommendations

Forward IBM i audit journal (QAUDJRN) entries to a centralized SIEM for correlation across hosts.
Alert on repeated File Server service restarts within short time windows.
Track authenticated user accounts generating high volumes of failed or malformed File Server requests.

How to Mitigate CVE-2026-81858

Immediate Actions Required

Apply the IBM security update referenced in the IBM Security Advisory for IBM i 7.3, 7.4, 7.5, and 7.6.
Restrict network access to the IBM i File Server to trusted management networks and known client subnets.
Review and reduce the number of user profiles with authority to connect to the File Server.
Enable auditing on File Server-related objects and user profiles to capture exploitation attempts.

Patch Information

IBM has released PTFs addressing CVE-2026-81858 for IBM i 7.3, 7.4, 7.5, and 7.6. Install the group PTFs listed in the IBM Security Advisory and verify installation using DSPPTF. Reload the File Server subsystem after applying the fix.

Workarounds

Disable the IBM i File Server (ENDHOSTSVR SERVER(*FILE)) on systems where file-serving is not required.
Enforce IP address filtering with exit programs registered for the File Server exit points to block untrusted clients.
Rotate credentials for low-privilege accounts that are exposed to the File Server surface.

bash

# Check installed PTFs and end the File Server host service if not needed
DSPPTF LICPGM(5770SS1)
ENDHOSTSVR SERVER(*FILE)