CVE-2026-4942 affects IBM i versions 7.3, 7.4, 7.5, and 7.6. It allows a remote attacker to perform an algorithm downgrade attack on the TLS protocol by sending a crafted message that forces the server to negotiate a TLS version that is disabled in the server configuration. This selection of a less-secure algorithm during negotiation can compromise the confidentiality of communications by forcing the use of weaker cryptographic protocols. The vulnerability is identified as CWE-757 and has a CVSS v3.1 base score of 5.9, indicating medium severity. No official remediation or patch information is currently provided by the vendor, and no known exploits are reported in the wild.

The vulnerability enables an attacker to downgrade the TLS protocol to a less secure version that the server has disabled, potentially exposing communications to weaker cryptographic protections. This can lead to confidentiality breaches if the downgraded protocol is vulnerable to known attacks. Integrity and availability are not impacted according to the available data.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is available, administrators should verify TLS configurations and monitor IBM advisories for updates. No vendor-provided mitigation or temporary fix is currently documented.