CVE-2026-17499: IBM i is Affected By Multiple Vulnerabilities in Debug Server

Q: What level of access does an attacker need to exploit this issue?

The issue requires local attacker access to IBM i.

Q: What is the potential impact of successful exploitation?

A local attacker could execute arbitrary commands because special elements used in an OS command are not properly neutralized.

Published Aug 31, 2026

Updated

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

Other sources

IBM i could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

— IBM

Affected Software

4 affected components

IBM i<=7.6

IBM i<=7.5

IBM i<=7.4

IBM i<=7.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM i 7.6 to a version that resolves this vulnerability.
Patch SJ11305
Upgrade
Upgrade IBM i 7.5 to a version that resolves this vulnerability.
Patch SJ11306
Upgrade
Upgrade IBM i 7.4 to a version that resolves this vulnerability.
Patch SJ11307
Upgrade
Upgrade IBM i 7.3 to a version that resolves this vulnerability.
Patch SJ11308

Event History

Aug 31, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Sep 4, 2026

CVE Published

via MITRE·04:31 PM

Data Sourced

via MITRE·04:31 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7285844

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?