This vulnerability (CVE-2026-17076) affects IBM i versions 7.3 through 7.6. It is classified under CWE-770, which involves allocation of resources without limits or throttling. The flaw arises from improper handling of Distributed Relational Database Architecture (DRDA) and Distributed Data Management (DDM) resynchronization requests, potentially enabling a remote attacker to cause a denial of service condition by exhausting system resources. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker can remotely send specially crafted DRDA and DDM resynchronization requests to the affected IBM i systems, causing resource exhaustion that leads to denial of service. Confidentiality and integrity are not impacted. The disruption affects system availability, potentially impacting business operations relying on the affected IBM i versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, organizations should monitor IBM security advisories for updates. Until a patch is available, consider limiting exposure of DRDA and DDM services to untrusted networks if feasible.