Description
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options.
Published: 2026-08-12
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in IBM i 7.6, 7.5, 7.4, and 7.3 allows a remote attacker to send specially crafted packets that contain zero‑length TCP options, forcing the target to enter a state that leads to a denial of service. The vulnerability is classified as CWE‑835, indicating an infinite‑loop or resource‑exhaustion condition that results in service unavailability.

Affected Systems

The defect affects IBM i systems running versions 7.6, 7.5, 7.4, and 7.3. IBM provides patch teams (PTFs) MJ10911 for 7.6, MJ10912 for 7.5, MJ10913 for 7.4, and MJ10914 for 7.3, which address the issue.

Risk and Exploitability

The CVSS score of 7.5 points to a high severity level. Exploitation does not require authentication and can be carried out by any external host capable of sending TCP packets with zero‑length options. Although an EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the potential for widespread denial of service and the lack of immediate mitigation make the risk significant. Remediation is essential, and systems still running supported or unsupported IBM i versions should be patched or upgraded promptly.

Generated by OpenCVE AI on August 12, 2026 at 22:45 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now. IBM i Release5770-999 PTF Number(s)PTF Download Link(s)7.6MJ10911 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ10911 7.5MJ10912 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ10912 7.4MJ10913 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ10913 7.3MJ10914 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ10914 IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied PTFs: MJ10911 for IBM i 7.6, MJ10912 for 7.5, MJ10913 for 7.4, and MJ10914 for 7.3.
  • If the system is on an unsupported or older release, upgrade to the latest supported IBM i release that contains the fix.
  • Restrict or isolate the affected IBM i system from external network traffic until the PTFs are applied to minimize exposure.

Generated by OpenCVE AI on August 12, 2026 at 22:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options.
Title IBM i is Affected By A Denial of Service Vulnerability []
First Time appeared Ibm
Ibm i
Weaknesses CWE-835
CPEs cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm i
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Ibm I
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-12T18:52:18.936Z

Reserved: 2026-07-24T07:27:02.461Z

Link: CVE-2026-16931

cve-icon Vulnrichment

Updated: 2026-08-12T18:52:15.577Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-12T18:17:25.010

Modified: 2026-08-12T20:53:43.330

Link: CVE-2026-16931

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-12T23:00:05Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')