IBM disclosed a stack-based buffer overflow in IBM i 7.6, 7.5, 7.4, and 7.3 that, per the vendor, could allow an unauthenticated remote attacker to execute arbitrary code. IBM rates it CVSS 9.8 CRITICAL.
What Is It
CVE-2026-17083 is a stack-based buffer overflow (CWE-787, out-of-bounds write) in IBM i. Per IBM's PSIRT description, the flaw "could allow a remote attacker to execute arbitrary code." The CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, describes the worst-case profile: network-reachable, low attack complexity, no privileges, and no user interaction, with high impact to confidentiality, integrity, and availability. Exploitability subscore is a maxed 3.9; impact subscore is 5.9.
The record was published 2026-08-12 by IBM's PSIRT ([email protected]) and currently sits in "Awaiting Analysis" status at NVD, meaning enrichment beyond the vendor-supplied data is still pending. No public proof-of-concept or technical write-up confirming code execution is available at this time, so the severity rating reflects the vendor's assessment rather than demonstrated exploitation.
Why It Matters
If the flaw is exploitable as the CVSS vector describes, pre-authentication remote code execution on IBM i is about as severe as it gets for the platform. IBM i systems typically run core business workloads, ERP, financial processing, transaction records, and are frequently long-lived, infrequently patched, and treated as trusted infrastructure inside the network perimeter. A vulnerability requiring no credentials and no user interaction would collapse that trust assumption entirely.
As of 2026-08-12, CVE-2026-17083 does not appear in CISA's Known Exploited Vulnerabilities catalog, and there are no public reports of active exploitation. No federal KEV remediation deadline applies to it at this time.
What's Vulnerable
IBM lists four affected release trains:
- IBM i 7.6 (including 7.6.0)
- IBM i 7.5 (including 7.5.0)
- IBM i 7.4 (including 7.4.0)
- IBM i 7.3 (including 7.3.0)
That the vulnerability spans every currently listed release line, from 7.3 through the newest 7.6, suggests the defective code path is long-standing rather than newly introduced.
Patch Status
IBM has published a support bulletin at node 7283276 covering this issue. Specific PTF numbers, fix levels, and workarounds are not reflected in the public CVE record; administrators should consult the IBM advisory directly for the remediation applicable to their release. Given a vendor-rated 9.8 pre-auth RCE, treat patching as urgent and, in the interim, restrict network reachability to affected IBM i hosts.
Sources
- NVD, CVE-2026-17083: https://nvd.nist.gov/vuln/detail/CVE-2026-17083
- IBM Support Bulletin (node 7283276): https://www.ibm.com/support/pages/node/7283276
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog