CVE-2026-17274: CWE-330 Use of Insufficiently Random Values

CVE-2026-17274 describes a vulnerability in IBM i versions 7.3 through 7.6 where the use of predictable server seeds (insufficiently random values) can be exploited by a remote authenticated attacker to bypass security restrictions. This weakness is categorized under CWE-330, which involves the use of insufficiently random values that can undermine security controls. The vulnerability requires the attacker to have some level of privileges (low) and does not require user interaction. The impact includes limited confidentiality and integrity loss but no availability impact.

The vulnerability allows a remote authenticated attacker to bypass security restrictions, potentially leading to limited confidentiality and integrity compromise within the affected IBM i systems. There is no indication of availability impact or active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, organizations should monitor IBM's advisories for updates and consider limiting remote authenticated access where possible.