IBM i DCM Vulnerabilities (CVE-2026-17043/88/71/69/45/75) and PTF Fixes

Vulnerability Overview IBM i has multiple vulnerabilities in the Digital Certificate Manager (DCM), specifically: 1. CVE-2026-17043 - Description: Allows a remote authenticated attacker to delete arbitrary files via path traversal. - CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - CVSS Base Score: 3.8 2. CVE-2026-17088 - Description: Allows a remote authenticated attacker to obtain sensitive information via a path traversal vulnerability. - CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - CVSS Base Score: 4.3 3. CVE-2026-17071 - Description: Allows a remote authenticated attacker to perform file operations via path traversal. - CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - CVSS Base Score: 2.7 4. CVE-2026-17069 - Description: Allows a remote authenticated attacker to bypass security restrictions by improperly validating anti-CSRF tokens. - CWE: CWE-352: Cross-Site Request Forgery (CSRF) - CVSS Base Score: 8.1 5. CVE-2026-17045 - Description: Allows a remote authenticated attacker to execute unauthorized actions and access sensitive information by improperly managing sessions. - CWE: CWE-294: Authentication Bypass by Capture-replay - CVSS Base Score: 8.1 6. CVE-2026-17075 - Description: Allows a remote attacker to obtain sensitive information and execute unauthorized actions by improperly validating authentication tokens. - CWE: CWE-287: Improper Authentication - CVSS Base Score: 6.5 Affected Products Affected Product: IBM i Affected Versions: 7.6, 7.5, 7.4, 7.3 Remediation IBM strongly recommends resolving these vulnerabilities immediately. The following remediation steps are provided for each version: IBM i 7.6 - PTF Number: S310907 - Download Link: https://www.ibm.com/mysupport/fix-information?legacy=s310907 IBM i 7.5 - PTF Number: S310906 - Download Link: https://www.ibm.com/mysupport/fix-information?legacy=s310906 IBM i 7.4 - PTF Number: S310905 - Download Link: https://www.ibm.com/mysupport/fix-information?legacy=s310905 IBM i 7.3 - PTF Number: S310904 - Download Link: https://www.ibm.com/mysupport/fix-information?legacy=s310904 IBM advises customers to upgrade unsupported versions of affected products to supported and patched versions. Additional Information Workarounds and Mitigations: None References: - Complete CVSS v3 Guide - Online CVSS v3 Calculator Related Information: - IBM Security Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer Per the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an industry open standard intended to convey vulnerability severity and help determine response urgency and priority. IBM provides CVSS scores "as is" and makes no express or implied warranties. Customers are responsible for evaluating the impact of any actual or potential security vulnerabilities. IBM periodically updates records for components within its product portfolio. As part of this effort, if IBM identifies previously unidentified packages, related vulnerabilities will be addressed in the product/service inventory regardless of the CVE date. The inclusion of older CVEIDs does not indicate that IBM was aware of the vulnerability from that date onward. We are working to inform customers of any related vulnerabilities we are aware of. IBM security bulletins cited in the referenced products and versions apply only to products and versions that are supported by IBM and have not expired. Therefore, unsupported or extended support products and versions not referenced in this security bulletin do not constitute an IBM determination that they are unaffected by the vulnerability. Citing one or more unsupported versions in this security bulletin does not impose any remediation obligation on IBM for unsupported or extended support products or versions. Cross-Reference Information Revision History August 12, 2026: Initial release CVSS Environment Scores are specific to a customer's environment and will ultimately impact the overall CVSS score. Customers can assess the impact of the vulnerability in their environment by accessing the links in the references section of this security bulletin.

Goal Reached Thanks to every supporter — we hit 100%!

IBM i DCM Vulnerabilities (CVE-2026-17043/88/71/69/45/75) and PTF Fixes

More from this source