CVE-2026-17068: IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System

Q: Which IBM i releases are affected?

IBM i 7.3, 7.4, 7.5, and 7.6 are identified as affected.

Q: What access does an attacker need to exploit this issue?

The issue is described as exploitable by a local attacker. The provided CVSS vector also indicates that low privileges are required and no user interaction is needed.

Q: What security impact could exploitation have?

Successful exploitation could allow bypass of NFS version restrictions. The CVSS vector indicates low impact to confidentiality and integrity, with no availability impact.

Published Oct 14, 2026

Updated

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.

Other sources

IBM i could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.

— IBM

Affected Software

5 affected components

IBM i<=7.6

IBM i<=7.5

IBM i<=7.4

IBM i<=7.3

IBM IBM i=7.3, =7.4, =7.5, =7.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.6Patch SJ11753
Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.5Patch SJ11790
Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.4Patch SJ11802
Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.3Patch SJ11804

Event History

Oct 14, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 16, 2026

CVE Published

via MITRE·06:39 PM

Data Sourced

via MITRE·06:39 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7292423

Frequently Asked Questions

Which IBM i releases are affected?

IBM i 7.3, 7.4, 7.5, and 7.6 are identified as affected.

What access does an attacker need to exploit this issue?

The issue is described as exploitable by a local attacker. The provided CVSS vector also indicates that low privileges are required and no user interaction is needed.

What security impact could exploitation have?

Successful exploitation could allow bypass of NFS version restrictions. The CVSS vector indicates low impact to confidentiality and integrity, with no availability impact.

CVE-2026-17068: IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which IBM i releases are affected?

What access does an attacker need to exploit this issue?

What security impact could exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Which IBM i releases are affected?

What access does an attacker need to exploit this issue?

What security impact could exploitation have?