I IBM I

  1. Vendors
  2. IBM
  3. I

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in IBM I.

By the Year

In 2026 there have been 160 vulnerabilities in IBM I with an average score of 6.6 out of ten. Last year, in 2025 I had 14 security vulnerabilities published. That is, 146 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.49




Year Vulnerabilities Average Score
2026 160 6.58
2025 14 7.06
2024 12 6.37
2023 13 7.48
2022 6 4.83
2021 30 6.10
2020 10 4.63
2019 27 6.00
2018 78 0.00

It may take a day or so for new I vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent IBM I Security Vulnerabilities

IBM i 7.3-7.6 NFS Version Restriction Bypass via Export Flag Weakness
CVE-2026-17068 5.4 - Medium - October 16, 2026

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.

AuthZ

IBM i 7.3-7.6 Local Info Disclosure via Missing Tree Check in File Handle
CVE-2026-17073 5.4 - Medium - October 16, 2026

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.

Authorization

IBM i 7.3-7.6 remote TA ID validation bypass allows unauthorized manipulation
CVE-2026-17275 3.7 - Low - October 16, 2026

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.

AuthZ

IBM i 7.3-7.6 Improper Auth Bypass Security Restrictions
CVE-2026-17488 4.3 - Medium - October 16, 2026

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

authentification

IBM i ChrootDirectory Bypass via Improper Enforcement (v7.3-7.6)
CVE-2026-17491 5.4 - Medium - October 16, 2026

IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive.

Improper Privilege Management

IBM i 7.3-7.6 Local DoS via Improper Access Control
CVE-2026-17484 5.3 - Medium - October 12, 2026

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.

Information Disclosure

IBM i 7.3-7.6 Remote User Enumeration via Sign-On Error Codes
CVE-2026-17487 5.3 - Medium - October 12, 2026

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.

Information Disclosure

IBM i 7.3-7.6 Improper Auth Enables Brute-Force Credential Theft
CVE-2026-18318 5.3 - Medium - October 12, 2026

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

Improper Restriction of Excessive Authentication Attempts

IBM i 7.37.6 BOOTP Table Mod via Improper Auth
CVE-2026-18343 4.4 - Medium - October 12, 2026

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.

Improper Privilege Management

IBM i 7.37.6 File Server OOB Read Denial of Service
CVE-2026-81858 5.4 - Medium - October 12, 2026

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.

Out-of-bounds Read

IBM i 7.3-7.6 Auth Script Exec via Improper Input Validation
CVE-2026-93886 8.3 - High - October 12, 2026

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

XSS

IBM i 7.3-7.6 HTTP Server Admin RCE via Improper Data Sanitization
CVE-2026-96119 9.9 - Critical - October 12, 2026

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

Code Injection

IBM i 7.6-7.3 Files Ownership Flaw via Path Validation (CVE-2026-84414)
CVE-2026-84414 7.8 - High - September 29, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path.

Incorrect Permission Assignment for Critical Resource

XEE in FTM 4.x Allows Remote Authenticated Sensitive Data Exfiltration
CVE-2026-93030 6.5 - Medium - September 25, 2026

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw.

XXE

IBM i 7.6/7.5/7.4/7.3: Remote AuthUser Bypass via FTP PORT/EPRT
CVE-2026-18869 6.4 - Medium - September 18, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation of FTP PORT and EPRT commands.

SSRF

IBM i 7.6-7.3 Local DoS via Improper FTP Auth Validation
CVE-2026-17262 5.4 - Medium - September 18, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to improper validation of FTP authentication commands.

Shell injection

IBM i 7.6 TOCTOU Race Allows Local File Ownership Escalation
CVE-2026-18069 6 - Medium - September 14, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use (TOCTOU) race condition.

TOCTTOU

IBM i 7.6 Denial of Service via PASE Buffer Overflow (CVE-2026-19086)
CVE-2026-19086 3.3 - Low - September 14, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminate their own process.

Out-of-bounds Read

IBM i 7.x Denial of Service via buffer overflow in PASE process
CVE-2026-19280 5.2 - Medium - September 14, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminate their own process.

Memory Corruption

Remote Session IP Binding Bypass in Navigator for i (IBM i)
CVE-2026-18065 5.3 - Medium - September 14, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i.

Authentication Bypass by Spoofing

IBM i 7.x WebSocket Origin Validation Flaw Enables Remote Info Disclosure
CVE-2026-18251 4.3 - Medium - September 14, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin.

1385

IBM i WebSocket Handshake Race Condition Enables Remote Info Disclosure
CVE-2026-18151 4.2 - Medium - September 14, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process.

Race Condition

IBM i Navigator for i: Remote Authenticated File Upload Vulnerability (7.6)
CVE-2026-18515 4.3 - Medium - September 14, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but only if the profile could already do that by itself.

Directory traversal

IBM i 7.3-7.6 Hardcoded Crypto Constants Remote Disclosure of Sensitive Data
CVE-2026-16693 4.4 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to the use of hardcoded cryptographic constants to obfuscate encryption keys.

Use of a Broken or Risky Cryptographic Algorithm

IBM i 7.6/7.5/7.4/7.3 Local Command Injection via Improper Sanitization
CVE-2026-16826 5.3 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

Shell injection

IBM i 7.67.3 Auth Bypass via ServiceName Matching
CVE-2026-16892 5.4 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication during service-name matching.

authentification

IBM i 7.6 Remote Auth System Msg Mod via Improper Auth
CVE-2026-16941 4.3 - Medium - September 04, 2026

IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify certain system messages due to improper authorization.

AuthZ

IBM i 7.6/7.5/7.4/7.3 Remote Auth Bypass Enables DoS & Data Integrity Impact
CVE-2026-17057 6.5 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and affect data integrity due to missing authentication for critical functions.

Missing Authentication for Critical Function

IBM i (7.6-7.3) Buffer Overflow Enables DoS & Integrity Compromise
CVE-2026-17207 6.5 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and compromise integrity due to a buffer overflow.

Memory Corruption

IBM i 7.6-7.3 Remote DoS via ICMPv6 Prefix Length Validation
CVE-2026-17255 4.3 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of the prefix length in ICMPv6 Router Advertisements.

Memory Corruption

IBM i 7.6 Stack Buffer Overflow Remote DoS
CVE-2026-17259 4.3 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow.

Stack Overflow

IBM i 7.3-7.6 Stack Buffer Overflow Denial of Service
CVE-2026-17270 4.3 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to a stack-based buffer overflow.

Stack Overflow

IBM i 7.6-7.3 NULL Deref DOS Remote Auth
CVE-2026-17273 6.5 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference.

NULL Pointer Dereference

IBM i 7.6/7.5/7.4/7.3 Security Bypass via Predictable Server Seeds
CVE-2026-17274 5.4 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds.

Use of Insufficiently Random Values

IBM i 7.6/7.5/7.4/7.3 LPD Queue Name Parser Off-by-One Write Causes DoS
CVE-2026-17469 5.3 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to an off-by-one write in the LPD queue name parser.

Memory Corruption

IBM i OS 7.6/7.5/7.4/7.3 Buffer Overflow DoS
CVE-2026-17470 5.3 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.

Memory Corruption

IBM i 7.6 Local Command Injection via Improper OS Command Neutralization
CVE-2026-17499 4.4 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

Shell injection

IBM i 7.x CL Command Param Injection (CVE-2026-18073)
CVE-2026-18073 4.4 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralization of special elements.

Shell injection

IBM i 7.x DOS via Remote Authenticated Integer Overflow
CVE-2026-18078 4.3 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to an integer overflow.

Integer Overflow or Wraparound

IBM i 7.6-7.3 Memory Leak Remote Authenticated DoS
CVE-2026-18076 4.3 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a memory leak.

Memory Leak

IBM i 7.6/7.5/7.4/7.3 Impr Auth in DDM Target Dis Enables Remote DB Tx Manip
CVE-2026-18175 8.1 - High - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher.

AuthZ

IBM i 7.6/7.5/7.4/7.3 auth param validation flaw
CVE-2026-18221 8.1 - High - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.

authentification

IBM i 7.x Memory Corruption via Integer Underflow (Remote Auth.)
CVE-2026-18341 6.3 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corrupt memory due to an integer underflow.

Heap-based Buffer Overflow

IBM i 7.6/7.5 SSH Local Auth Privileged File Disclosure
CVE-2026-18858 3.3 - Low - September 04, 2026

IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from a privileged file when using SSH.

Privilege Defined With Unsafe Actions

IBM i 7.6-7.3 PASE Authenticated Process Info Disclosure
CVE-2026-18887 6.5 - Medium - September 04, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sensitive information in PASE. An attacker could exploit this vulnerability to access information about process they shouldn't be permitted to access.

Information Disclosure

IBM i OOB read causing DoS & data exposure in 7.6/7.5/7.4/7.3 (CVE-2026-17015)
CVE-2026-17015 5.4 - Medium - August 19, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service and obtain sensitive information due to an out-of-bounds read.

Out-of-bounds Read

IBM i v7.6 and below: remote auth can overflow via int underflow
CVE-2026-18102 3.5 - Low - August 19, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to overwrite adjacent memory due to an integer underflow during bounds checking.

Heap-based Buffer Overflow

Remote Authenticated Info Disclosure via XML External Entities in IBM i 7.6-7.3
CVE-2026-18715 6.5 - Medium - August 13, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities.

XXE

IBM i 7.6/7.5/7.4/7.3 NetServer Int Overflow DoS
CVE-2026-18671 6.5 - Medium - August 13, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused by an integer overflow during bounds checking in request processing. The attacker could exploit this vulnerability to cause a temporary denial of service.

Integer Overflow or Wraparound

IBM i 7.6-7.3 JSSE provider stack overflow via TLS session
CVE-2026-18511 7.3 - High - August 13, 2026

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the Native IBM i JSSE provider, caused by improper bounds checking during TLS session establishment. A local attacker could overflow a fixed-length buffer and execute arbitrary code on the system or cause the JVM process to crash.

Memory Corruption

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for IBM I or by IBM? Click the Watch button to subscribe.

IBM
Vendor

IBM I
Product

subscribe