Description
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
Published: 2026-08-13
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an out‑of‑bounds read in IBM i NetServer that lets a remote attacker read data outside the intended buffer, potentially exposing sensitive information. The flaw is a classic CWE‑125 vulnerability and can lead to information disclosure without authentication.

Affected Systems

IBM i running releases 7.3, 7.4, 7.5 and 7.6 are affected. IBM provides public PTFs (MJ10936 through MJ10939) to address the issue. Users of unsupported releases should upgrade to a supported, fixed version of IBM i.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate risk. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting a low exploitation probability in the near term. Attackers would likely target the NetServer service over the network, but no publicly disclosed exploit is known and the flaw requires remote access to the affected server.

Generated by OpenCVE AI on August 13, 2026 at 21:30 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now. IBM i Release5770-999 PTF Number(s)PTF Download Link(s)7.6MJ10939 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ10939 7.5MJ10938 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ10938 7.4MJ10937 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ10937 7.3MJ10936 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ10936 IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.

OpenCVE Recommended Actions

  • Apply the IBM PTFs MJ10936, MJ10937, MJ10938, and MJ10939 to the affected releases.
  • If running an unsupported release, upgrade to a supported and fixed version of IBM i.
  • Disable or restrict access to the NetServer service when it is not required for business operations.

Generated by OpenCVE AI on August 13, 2026 at 21:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Description IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
Title IBM i is Affected By Multiple Vulnerabilities in NetServer
First Time appeared Ibm
Ibm i
Weaknesses CWE-125
CPEs cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm i
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Ibm I
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-13T19:50:04.257Z

Reserved: 2026-07-24T03:46:58.241Z

Link: CVE-2026-16859

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-08-13T20:17:15.450

Modified: 2026-08-13T20:36:48.443

Link: CVE-2026-16859

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T22:00:05Z

Weaknesses