CVE-2026-77153 · Infrastructure
NO FIX YET
IBM i versions 7.3 through 7.6 lack an authorization check in the Host-Based Printer Subsystem. A remote attacker without credentials can obtain sensitive information by printing files they should not be able to reach.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
IBM i 7.3, 7.4, 7.5 and 7.6 systems that run the Host-Based Printer Subsystem are exposed to remote requests. The sources do not say which configurations are affected beyond that, or whether the subsystem is enabled by default. Teams on other IBM i releases, or without the printer subsystem in use, can skip it.
Not affected if other-release
Who cares as400, ibm-i, printing
DSPPTF or the Display Software Resources screen, and check whether it is 7.3, 7.4, 7.5 or 7.6.No fix yet, per the sources.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to obtain sensitive information from the Host-Based Printer Subsystem due to no authorization check. A bad actor could use this vulnerability to print files they should not be able to access.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.