IBM i JSSE Multiple Vulnerabilities Advisory (CVE-2026-17029, 18511)

Vulnerability Overview IBM i is affected by multiple Java Secure Sockets Extension (JSSE) vulnerabilities, specifically: CVE-2026-17029: Allows a local attacker to execute arbitrary code via out-of-bounds write. CVE-2026-18511: Allows a locally authenticated attacker to execute arbitrary code or cause a JVM process crash via stack buffer overflow. CVE-2026-18068: Allows a remote attacker to obtain sensitive information via confusion of byte counts and element counts. CVE-2026-18086: Allows a local attacker to execute arbitrary code or cause denial of service via improper boundary checking. Affected Products The following IBM i versions are affected: 7.6 7.5 7.4 7.3 Remediation IBM strongly recommends resolving these vulnerabilities immediately. Below are the remediation steps for each version: IBM i 7.6 PTF Numbers: S311036, S311072, S311082, S311088 Download Links: - S311036 - S311072 - S311082 - S311088 IBM i 7.5 PTF Numbers: S311068, S311073, S311070, S311077, S311087 Download Links: - S311068 - S311073 - S311070 - S311077 - S311087 IBM i 7.4 PTF Numbers: S311071, S311069, S311076, S311086 Download Links: - S311071 - S311069 - S311076 - S311086 IBM i 7.3 PTF Numbers: S311067, S311075, S311085 Download Links: - S311067 - S311075 - S311085 IBM recommends that users upgrade unsupported affected product versions to supported and remediated versions. Additional Information Workarounds and Mitigations: None References: - Complete CVSS v3 Guide - On-line Calculator v3 Related Information: - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an industry open standard designed to communicate vulnerability severity and help determine response urgency and priority. IBM provides CVSS scores "as is" and makes no representations or warranties, express or implied. Customers are responsible for evaluating the impact of any actual or potential security vulnerabilities. IBM regularly updates the records of related vulnerabilities included in its product portfolio. As part of this effort, IBM identifies packages in the product/service list that were previously unrecognized and addresses related vulnerabilities, regardless of the CVE date. Inclusion of older CVEIDs does not indicate that IBM was aware of the vulnerability at the date the referenced product was used. IBM alerts customers to related vulnerabilities as it becomes aware of them. The IBM security notices referenced in "Affected Products and Versions" apply only to products and versions that are supported by IBM and have not reached end-of-support. Therefore, the failure to reference unsupported or extended support products and versions does not constitute a determination by IBM that they are not affected by the vulnerability. The one or more unsupported versions referenced in this security notice should not be construed as an obligation by IBM to remediate any unsupported or extended support product or version. Cross-Reference Information IBM i IBM i 7.3 Preventive Service Planning IBM i 7.4 Preventive Service Planning IBM i 7.5 Preventive Service Planning IBM i 7.6 Preventive Service Planning Revision History August 12, 2026: Initial Release CVSS Environmental scores are specific to the customer's environment and will ultimately affect the Overall CVSS score. Customers can assess the impact of this vulnerability in their environment by visiting the links in the References section of this security notice.

Goal Reached Thanks to every supporter — we hit 100%!

IBM i JSSE Multiple Vulnerabilities Advisory (CVE-2026-17029, 18511)