CVE-2026-17488: IBM i is Affected By An Improper Authentication Vulnerability in SST / DST

Q: Who can exploit this issue?

A remote attacker who is already authenticated can exploit it. The provided information does not indicate that unauthenticated attackers can use this vulnerability.

Q: Which IBM i releases are identified as affected?

IBM i 7.3, 7.4, 7.5, and 7.6 are identified as affected.

Q: What is the expected impact if exploitation succeeds?

An authenticated remote attacker may bypass security restrictions. The supplied severity vector indicates low confidentiality impact and no stated integrity or availability impact.

Published Oct 13, 2026

Updated

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

Other sources

IBM i could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

— IBM

Affected Software

9 affected components

IBM i<=7.6

IBM i<=7.5

IBM i<=7.4

IBM i<=7.3

IBM IBM i=7.3, =7.4, =7.5, =7.6

IBM i=7.3

IBM i=7.4

IBM i=7.5

IBM i=7.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM i 7.6 to a version that resolves this vulnerability.
Patch MJ11751
Upgrade
Upgrade IBM i 7.5 to a version that resolves this vulnerability.
Patch MJ11749
Upgrade
Upgrade IBM i 7.4 to a version that resolves this vulnerability.
Patch MJ11750
Upgrade
Upgrade IBM i 7.3 to a version that resolves this vulnerability.
Patch MJ11748

Event History

Oct 13, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 16, 2026

CVE Published

via MITRE·06:38 PM

Data Sourced

via MITRE·06:38 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7292270

Frequently Asked Questions

Who can exploit this issue?

A remote attacker who is already authenticated can exploit it. The provided information does not indicate that unauthenticated attackers can use this vulnerability.

Which IBM i releases are identified as affected?

IBM i 7.3, 7.4, 7.5, and 7.6 are identified as affected.

What is the expected impact if exploitation succeeds?

An authenticated remote attacker may bypass security restrictions. The supplied severity vector indicates low confidentiality impact and no stated integrity or availability impact.

CVE-2026-17488: IBM i is Affected By An Improper Authentication Vulnerability in SST / DST

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

Which IBM i releases are identified as affected?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact