CVE-2026-17057

IBM i is Affected By Denial of Service Vulnerabilities in NFS [, ]

Published Sep 4, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and affect data integrity due to missing authentication for critical functions.

Analysis

Technical impact

The vulnerability is caused by a missing authentication requirement for critical NFS functions in IBM i 7.3, 7.4, 7.5, and 7.6, allowing a remote attacker to trigger a denial of service and potentially compromise data integrity. This flaw is classified as an authentication failure (CWE-306). The attack vector is remote, requiring the attacker to send unauthenticated requests to the NFS service.

Affected Systems

IBM i versions 7.3 through 7.6 are affected. Any configuration that exposes the NFS service without proper authentication is vulnerable, regardless of the operating environment.

Risk and Exploitability

The CVSS base score of 6.5 indicates medium severity, and the vulnerability is not listed in the KEV catalog. EPSS data is not available, so the probability of exploitation is unknown. The exploit requires network access to the NFS service and the ability to send unauthenticated requests, which can lead to service interruption and data corruption. Systems exposed to untrusted networks face a moderate risk.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

IBM

affected

Version	Status	Constraints
`7.6`	affected	—
`7.5`	affected	—
`7.4`	affected	—
`7.3`	affected	—

Configuration 1 [-]

OR	cpe:2.3:o:ibm:i:7.3:::::::*
	cpe:2.3:o:ibm:i:7.4:::::::*
	cpe:2.3:o:ibm:i:7.5:::::::*
	cpe:2.3:o:ibm:i:7.6:::::::*

No data.

Vendor Product Versions

Ibm

Version	Status	Scheme	Platform
`7.6`	affected	generic	—
`7.5`	affected	generic	—
`7.4`	affected	generic	—
`7.3`	affected	generic	—

Remediation

Vendor Solution

IBM i Release5770-SS1 PTF Number(s)PTF Download Link(s)7.6SJ11320 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11320 7.5SJ11319 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11319 7.4SJ11318 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11318 7.3SJ11317 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11317 IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.

OpenCVE Recommended Actions

Apply the IBM i Release5770-SS1 PTF for your version (SJ11320 for 7.6, SJ11319 for 7.5, SJ11318 for 7.4, SJ11317 for 7.3).
Upgrade to a supported, fixed IBM i release if you are running an unsupported version.
If immediate patching is unavailable, block external access to the NFS service or enforce strict authentication controls around it.

Generated by OpenCVE AI on September 4, 2026 at 17:58 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.570% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.ibm.com/support/pages/node/7285847

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 8, 2026 5:30 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:ibm:i:7.3:::::::* cpe:2.3:o:ibm:i:7.4:::::::* cpe:2.3:o:ibm:i:7.5:::::::* cpe:2.3:o:ibm:i:7.6:::::::*

Sep 4, 2026 4:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and affect data integrity due to missing authentication for critical functions.
Title		IBM i is Affected By Denial of Service Vulnerabilities in NFS [, ]
First Time appeared		Ibm Ibm i
Weaknesses		CWE-306
CPEs		cpe:2.3:a:ibm:i:7.3.0:::::::* cpe:2.3:a:ibm:i:7.3:::::::* cpe:2.3:a:ibm:i:7.4.0:::::::* cpe:2.3:a:ibm:i:7.4:::::::* cpe:2.3:a:ibm:i:7.5.0:::::::* cpe:2.3:a:ibm:i:7.5:::::::* cpe:2.3:a:ibm:i:7.6.0:::::::* cpe:2.3:a:ibm:i:7.6:::::::*
Vendors & Products		Ibm Ibm i
References		https://www.ibm.com/support/pages/node/7285847
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}`