Live › vulnerability › CVE-2026-17488
Go to dashboardIBM i versions 7.3 through 7.6 have an improper authentication flaw. A remote attacker who already holds valid credentials can bypass security restrictions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
IBM i 7.3, 7.4, 7.5 and 7.6 systems are affected, and the attacker must already have a valid user on the system. Teams running IBM i partitions that accept remote logins (for example through network services or ODBC/JDBC access) should look at this first. The sources do not describe a specific configuration, so systems without remote user access are unlikely to be exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ibm i | vendor | = 7.3 | – |
| ibm i | vendor | = 7.4 | – |
| ibm i | vendor | = 7.5 | – |
| ibm i | vendor | = 7.6 | – |
DSPPTF or GO LICPGM on the IBM i partition and compare it to the fixed levels in IBM's bulletinEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
This page as .md · .json · in your agent: get_signal("CVE-2026-17488")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.