CVE-2026-17438

Analyzed Analyzed - Analysis Complete

Improper Privilege Management in IBM i

Publication date: 2026-08-13

Last updated on: 2026-08-19

Assigner: IBM Corporation

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-19

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-01

NVD

CVE-2026-17438

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	i	7.3
ibm	i	7.4
ibm	i	7.5
ibm	i	7.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM i 7.6, 7.5, 7.4, and 7.3 allows a local attacker to access sensitive information or alter data due to incorrect privilege management. This means the system does not properly restrict user permissions, enabling unauthorized actions.

Detection Guidance

This vulnerability involves improper privilege management in IBM i systems. Detection requires checking user permissions and system configurations. Use IBM i commands like DSPUSRPRF to review user profiles, WRKSYSVAL to check system values, and DSPPTAUT to examine adopted authority settings. Compare configurations against IBM's recommended security settings.

Impact Analysis

If exploited, this flaw could let attackers steal confidential data or modify critical system information. Users with local access might gain elevated privileges, leading to data breaches or system integrity issues.

Compliance Impact

The vulnerability allows local attackers to obtain sensitive information or modify data due to improper privilege management. This could lead to unauthorized access to personal or sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy).

Mitigation Strategies

Apply IBM i PTFs or updates to address improper privilege management. Review and restrict user privileges to minimize local access risks. Monitor for unauthorized changes or data access.

Hi! I’m here to help you understand CVE-2026-17438. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70