Description
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.
Published: 2026-10-12
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service and potential information disclosure
Action: Immediate Patch
AI Analysis

Impact

An out‑of‑bounds read in the File Server can cause the service to crash and expose memory contents to an attacker. The flaw allows a remote authenticated attacker to bring the File Server down and obtain sensitive information, resulting in loss of availability and a confidentiality breach.

Affected Systems

IBM i versions 7.3, 7.4, 7.5 and 7.6 are affected. The vulnerability resides in the File Server component of these operating system releases.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, so a current exploitation probability cannot be quantified. The attack requires remote authenticated access; no public exploit is reported, but any valid user with sufficient privileges could abuse the flaw to cause a denial of service and expose data.

Generated by OpenCVE AI on October 13, 2026 at 00:31 UTC.

Remediation

Vendor Solution

IBM i Release5770-SS1  PTF Number(s)PTF Download Link(s)7.6SJ11622 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11622 7.5SJ11621 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11621 7.4SJ11620 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11620 7.3SJ11619 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11619 IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.

OpenCVE Recommended Actions

  • Apply the IBM i Release5770‑SS1 PTFs: SJ11622 for 7.6, SJ11621 for 7.5, SJ11620 for 7.4, and SJ11619 for 7.3.
  • Upgrade to a supported and patched version of IBM i if running an unsupported release.
  • If the File Server is not required, disable the service to reduce the attack surface.

Generated by OpenCVE AI on October 13, 2026 at 00:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:ibm:i:*:*:*:*:*:*:*:*

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
Description IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.
Title IBM i is Affected By A Denial of Service Vulnerability in Host Servers
First Time appeared Ibm
Ibm i
Weaknesses CWE-125
CPEs cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm i
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L'}

Subscriptions

Ibm I
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-13T13:48:37.584Z

Reserved: 2026-08-27T16:37:56.325Z

Link: CVE-2026-81858

cve-icon Vulnrichment

Updated: 2026-10-13T13:48:00.955Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T00:17:01.807

Modified: 2026-10-14T23:48:42.867

Link: CVE-2026-81858

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T01:30:06Z

Weaknesses