CVE-2026-17487: IBM i is Information Disclosure
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.
Other sources
IBM i could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Patch MJ11633 - Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Patch MJ11634 - Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Patch MJ11635 - Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Patch MJ11636 - Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Patch MJ11438 - Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Patch MJ11439 - Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Patch MJ11441 - Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Patch MJ11448
Event History
Frequently Asked Questions
Which IBM i releases are affected?
IBM i 7.3, 7.4, 7.5, and 7.6 are listed as affected.
Does exploitation require authentication or user interaction?
No. The listed vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What information can an attacker obtain?
An attacker can enumerate user profiles by observing distinct error codes returned during the sign-on process. The reported impact is limited to confidentiality.