CVE-2026-107674

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in IBM i Digital Certificate Manager

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: IBM Corporation

Description

IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service from starting or cause it to fallback to non-secure connections.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-107674

EUVD

EUVD-2026-103018

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	i	7.6
IBM	i	7.5
IBM	i	7.4
IBM	i	7.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-667	The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Attack-Flow Graph

Executive Summary

IBM i versions 7.3 through 7.6 have a denial of service vulnerability in Digital Certificate Manager (DCM) for System TLS. Attackers could exploit this to disrupt secure network connections by preventing services from starting or forcing them to use insecure connections.

Detection Guidance

This vulnerability affects IBM i systems running versions 7.3 to 7.6, specifically impacting Digital Certificate Manager (DCM) for System TLS. Monitor for failed secure connection attempts or service startup failures in DCM. Check system logs for errors related to TLS handshakes or certificate validation. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow attackers to disrupt critical services that rely on secure TLS connections. It may cause system downtime, expose sensitive data by forcing fallback to unencrypted connections, or enable further attacks through network interception.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling data breaches through insecure connections. GDPR requires secure data transmission, while HIPAA mandates encrypted communications for protected health information.

Mitigation Strategies

Apply IBM i PTFs or updates addressing this issue as soon as they become available. Temporarily disable DCM for System TLS if secure connections are not critical. Ensure fallback to non-secure connections is disabled to prevent exploitation. Monitor IBM i security bulletins for patches.

Hi! I’m here to help you understand CVE-2026-107674. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70