CVE-2026-17073: IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System

Q: Who can exploit this issue?

The affected systems are IBM i 7.3, 7.4, 7.5, and 7.6. Exploitation requires local attacker access and low privileges; no user interaction is required.

Q: What is the potential impact?

A local attacker may obtain sensitive information because subtree checks are missing during Network File System file-handle resolution. The provided severity vector also indicates potential low-impact integrity effects.

Q: Is this remotely exploitable?

The provided CVSS vector lists network attack vector access (AV:N), while the advisory description characterizes the attacker as local. The available data does not resolve this difference, so exposure should be validated against IBM's advisory.

Published Oct 14, 2026

Updated

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.

Other sources

IBM i could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.

— IBM

Affected Software

5 affected components

IBM i<=7.6

IBM i<=7.5

IBM i<=7.4

IBM i<=7.3

IBM IBM i=7.3, =7.4, =7.5, =7.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.6Patch SJ11753
Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.5Patch SJ11790
Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.4Patch SJ11802
Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.3Patch SJ11804

Event History

Oct 14, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 16, 2026

CVE Published

via MITRE·06:39 PM

Data Sourced

via MITRE·06:39 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7292423

Frequently Asked Questions

Who can exploit this issue?

The affected systems are IBM i 7.3, 7.4, 7.5, and 7.6. Exploitation requires local attacker access and low privileges; no user interaction is required.

What is the potential impact?

A local attacker may obtain sensitive information because subtree checks are missing during Network File System file-handle resolution. The provided severity vector also indicates potential low-impact integrity effects.

Is this remotely exploitable?

The provided CVSS vector lists network attack vector access (AV:N), while the advisory description characterizes the attacker as local. The available data does not resolve this difference, so exposure should be validated against IBM's advisory.

CVE-2026-17073: IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact?

Is this remotely exploitable?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact?

Is this remotely exploitable?