CVE-2026-17073: IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.
Other sources
IBM i could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Fixed in 7.6Patch SJ11753 - Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Fixed in 7.5Patch SJ11790 - Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Fixed in 7.4Patch SJ11802 - Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Fixed in 7.3Patch SJ11804
Event History
Frequently Asked Questions
Who can exploit this issue?
The affected systems are IBM i 7.3, 7.4, 7.5, and 7.6. Exploitation requires local attacker access and low privileges; no user interaction is required.
What is the potential impact?
A local attacker may obtain sensitive information because subtree checks are missing during Network File System file-handle resolution. The provided severity vector also indicates potential low-impact integrity effects.
Is this remotely exploitable?
The provided CVSS vector lists network attack vector access (AV:N), while the advisory description characterizes the attacker as local. The available data does not resolve this difference, so exposure should be validated against IBM's advisory.