CVE-2026-107674: IBM i is Affected by a Denial of Service in Digital Certificate Manager

Published Oct 16, 2026

Updated

IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service from starting or cause it to fallback to non-secure connections.

Affected Software

1 affected component

IBM IBM i=7.3, =7.4, =7.5, =7.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM i 7.6 Digital Certificate Manager to a version that resolves this vulnerability.
Patch SJ11846
Upgrade
Upgrade IBM i 7.5 Digital Certificate Manager to a version that resolves this vulnerability.
Patch SJ11845
Upgrade
Upgrade IBM i 7.4 Digital Certificate Manager to a version that resolves this vulnerability.
Patch SJ11844
Upgrade
Upgrade IBM i 7.3 Digital Certificate Manager to a version that resolves this vulnerability.
Patch SJ11843

Event History

Oct 16, 2026

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability has a local attack vector and requires high privileges. It does not require user interaction.

Which IBM i releases are affected?

IBM i 7.3, 7.4, 7.5, and 7.6 are listed as affected.

What operational impact should teams expect?

Digital Certificate Manager for System TLS can be subjected to denial of service when applications attempt to create secure network connections. This may prevent a service from starting or cause it to fall back to non-secure connections.