Threat database

IBM Documentation Offline versions 1.0.0 through 1.4.1 contain a vulnerability due to the use of a hardcoded cryptographic key. This flaw could allow a remote attacker to forge valid session tokens. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation guidance has been provided yet.

IBM i versions 7.3 through 7.6 contain an improper authentication vulnerability that could allow a remote attacker to obtain sensitive information and perform unauthorized operations due to improper validation of authentication tokens. The vulnerability has a medium severity rating with a CVSS score of 6.5. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.

CVE-2026-17272 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6 that allows a remote attacker to cause a denial of service via a buffer overflow (CWE-787). The vulnerability does not impact confidentiality but can lead to integrity loss and service disruption. No official patch or remediation guidance has been provided yet.

CVE-2026-17226 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves an out-of-bounds read that could allow a remote authenticated attacker to access sensitive information or cause a denial of service. The vulnerability requires low attack complexity and no user interaction. No official patch or remediation guidance is currently confirmed.

IBM i versions 7.3 through 7.6 contain an integer overflow vulnerability in the processing of DRDA large-object headers that could allow a remote attacker to cause a denial of service. The issue arises from an integer error leading to application disruption without impacting confidentiality or integrity.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

CVE-2026-17101 is a high-severity vulnerability in IBM i versions 7.3 through 7.6 that involves improper authentication. This flaw could allow a remote attacker to execute arbitrary code or access sensitive information. The vulnerability has a CVSS score of 8.3, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet. There are no known exploits in the wild at this time.

CVE-2026-17099 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6 that involves improper authentication. This flaw could allow a remote attacker to obtain sensitive information without proper authorization. The vulnerability affects multiple IBM i releases and has a CVSS score of 7.3, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a path traversal vulnerability (CWE-22) that could allow a remote authenticated attacker to access sensitive information. The vulnerability does not require user interaction and has a medium severity rating with a CVSS score of 4.3. No official patch or remediation guidance has been provided yet.

IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a vulnerability that could allow a remote attacker to cause a denial of service by exhausting system resources. This issue is categorized as CWE-400, indicating uncontrolled resource consumption. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitialized variable.

CVE-2026-17076 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves improper processing of DRDA and DDM resynchronization requests that could allow a remote attacker to cause a denial of service by allocating resources without limits or throttling.

CVE-2026-17074 is a low severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6 where improper privilege management could allow a remote authenticated attacker to bypass security restrictions. The vulnerability does not impact confidentiality or availability but may allow limited integrity compromise. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-17071 is a path traversal vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It allows a remote authenticated attacker to perform unauthorized file manipulation by exploiting improper limitation of pathnames to restricted directories. The vulnerability has a low severity score and does not impact confidentiality or availability but can affect integrity.

IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a Cross-Site Request Forgery (CSRF) vulnerability due to improper validation of anti-CSRF tokens. This flaw allows a remote authenticated attacker to bypass security restrictions without user interaction. The vulnerability has a high severity score of 8.1 and impacts confidentiality and integrity. No official patch or remediation guidance is currently provided by the vendor.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management.

CVE-2026-17043 is a path traversal vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6 that allows a remote authenticated attacker to delete arbitrary files. The vulnerability arises from improper limitation of pathname to a restricted directory. The CVSS score is 3.8, indicating low severity. No official patch or remediation guidance is currently available. There are no known exploits in the wild at this time.

CVE-2026-17029 is a high-severity vulnerability in IBM i versions 7.3 through 7.6 that allows a local attacker to execute arbitrary code due to an out-of-bounds write condition. This vulnerability affects IBM i 7.3, 7.4, 7.5, and 7.6. The flaw could lead to complete compromise of confidentiality, integrity, and availability of the affected system. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-16987 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves improper validation of the LANG environment variable, which could allow a local attacker to gain elevated privileges. The vulnerability is classified under CWE-73, indicating external control of file name or path. No official patch or remediation information is currently available.

CVE-2026-16975 is a high severity vulnerability affecting IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves a heap-based buffer overflow that could allow a remote authenticated attacker to execute arbitrary code. The vulnerability has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.