IBM i Security Bulletin: CVEs-2026-17216/17077/17074/17076 PTF Fix Advisory

Vulnerability Overview IBM i is affected by multiple vulnerabilities, specifically: 1. CVE-2026-17216 - Description: IBM may allow remote attackers to cause a denial of service via an integer error when processing DRDA large object headers. - CWE: CWE-190: Integer Overflow or Wraparound - CVSS Base Score: 5.3 2. CVE-2026-17077 - Description: IBM may allow remote attackers to cause a denial of service via the use of an uninitialized variable. - CWE: CWE-457: Use of Uninitialized Variable - CVSS Base Score: 5.3 3. CVE-2026-17074 - Description: IBM may allow authenticated remote attackers to bypass security restrictions via improper access control. - CWE: CWE-269: Improper Privilege Management - CVSS Base Score: 3.1 4. CVE-2026-17076 - Description: IBM may allow remote attackers to cause a denial of service via improper handling of DRDA and DDM resynchronization requests. - CWE: CWE-770: Allocation of Resources Without Limits or Throttling - CVSS Base Score: 5.3 Affected Versions Affected IBM i versions include: 7.6 7.5 7.4 7.3 Remediation IBM provides the following Program Temporary Fixes (PTFs): IBM recommends that users upgrade unsupported affected product versions to supported and fixed versions. Additional Information Workarounds and Mitigations: None References: - Full CVSS v3 Guide - Online Calculator v3 Related Information: - IBM Security Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer The Common Vulnerability Scoring System (CVSS) is an open industry standard developed by the Forum of Incident Response and Security Teams (FIRST) designed to convey vulnerability severity and help determine response urgency and priority. IBM provides CVSS scores "as is" without any express or implied warranties. Customers are responsible for assessing the impact of any actual or potential security vulnerabilities. IBM periodically updates component records in its product portfolio and addresses related vulnerabilities if previously unidentified packages are discovered, regardless of the CVE date. The inclusion of an older CVEID does not indicate that the vulnerability was known to IBM at the time of release. Affected products and versions refer only to supported and non-end-of-life products and versions. Citing unsupported or extended support products and versions does not constitute a determination by IBM that they are unaffected by the vulnerability, nor does it constitute an obligation by IBM to provide a fix for any unsupported or extended support product or version. Cross-Reference Information IBM i IBM i 7.3 Preventive Service Planning IBM i 7.4 Preventive Service Planning IBM i 7.5 Preventive Service Planning IBM i 7.6 Preventive Service Planning Summary IBM i is affected by multiple vulnerabilities involving denial of service and access control issues. Affected versions include 7.6, 7.5, 7.4, and 7.3. IBM has provided corresponding fix patches, and users are advised to update promptly.

Goal Reached Thanks to every supporter — we hit 100%!

IBM i Security Bulletin: CVEs-2026-17216/17077/17074/17076 PTF Fix Advisory

More from this source