Skip to content
OpenAdvisories
High NCSC-2026-0301 19 CVEs

Kwetsbaarheden verholpen in IBM i operating system door IBM

Published Aug 14, 2026 · Updated Aug 14, 2026 · nl

Vendor: IBM Product: i

Summary

IBM heeft kwetsbaarheden verholpen in IBM i operating system versies 7.3, 7.4, 7.5 en 7.6.

Details

Interpretaties
De kwetsbaarheden betreffen meerdere aspecten van het IBM i - operating system, waaronder onjuist privilege management, onbeheerde zoekpadelementen, out-of-bounds reads en writes, buffer overflows (zowel heap- als stackgebaseerd), SQL-injecties, path traversal, TOCTOU-racecondities met symbolische links, onjuiste validatie van omgevingsvariabelen en profielnamen, en onjuiste neutralisatie van speciale elementen in OS-commando's. Aanvallers met geldige authenticatie kunnen deze kwetsbaarheden misbruiken om privileges te escaleren, willekeurige code uit te voeren, toegang te verkrijgen tot gevoelige gegevens, de systeemintegriteit te compromitteren of een denial-of-service te veroorzaken. De kwetsbaarheden zijn aanwezig in meerdere opeenvolgende versies van IBM i waarvoor meerdere updates zijn uitgebracht. Het advies van het NCSC is dan ook om goed te controleren of de in gebruik zijnde versie onder de kwetsbare versies valt.

Oplossingen
IBM heeft updates uitgebracht om de kwetsbaarheden in IBM i operating system versies 7.3 tot en met 7.6 te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 19

  • Critical 9.9
    CVE-2026-16860

    IBM i is Affected By Remote Code Execution Vulnerability []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.

    IBM i
  • Critical 9.8
    CVE-2026-17083

    IBM i is Affected By Multiple Vulnerabilities in the Debug Server

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.

    IBM i
  • Critical 9.8
    CVE-2026-17218

    IBM i is Affected By Remote Code Execution Vulnerability in Line Printer Daemon []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

    IBM i
  • High 8.8
    CVE-2026-16722

    IBM i is Affected By An Unauthorized Privileges Vulnerability in SQL []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management.

    IBM i
  • High 8.8
    CVE-2026-16975

    IBM i is Affected By A Remote Code Execution Vulnerability []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a heap-based buffer overflow.

    IBM i
  • High 8.8
    CVE-2026-16987

    IBM i is Affected By An Improper Validation Vulnerability in PASE []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable.

    IBM i
  • High 8.8
    CVE-2026-17082

    IBM i is Affected By Multiple Vulnerabilities in the Debug Server

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name.

    IBM i
  • High 8.8
    CVE-2026-17417

    IBM i is Affected By Remote Code Execution Vulnerabilities [, ]

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters.

    IBM i
  • High 8.8
    CVE-2026-17642

    IBM i is Affected By Remote Code Execution Vulnerabilities [, ]

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

    IBM i
  • High 8.8
    CVE-2026-18669

    IBM i is Affected By A Privilege Escalation Vulnerability []

    IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component. An authenticated attacker can execute a maliciously planted script with root authority.

    IBM i
  • High 8.5
    CVE-2026-16908

    IBM i is Affected By Multiple SQL Vulnerabilities [, ]

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path traversal vulnerability.

    IBM i
  • High 8.5
    CVE-2026-16967

    IBM i is Affected By Multiple SQL Vulnerabilities [, ]

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system objects due to a time-of-check to time-of-use (TOCTOU) race condition involving symbolic links.

    IBM i
  • High 8.2
    CVE-2026-17272

    IBM i is Affected By a Denial of Service in HTTP Server []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.

    IBM i
  • High 8.2
    CVE-2026-17445

    IBM i is Affected By Improper Validation Vulnerability in Line Printer Daemon []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile name.

    IBM i
  • High 7.7
    CVE-2026-16863

    IBM i is Affected By Out-of-Bounds Read Vulnerability []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.

    IBM i
  • High 7.6
    CVE-2026-16907

    IBM i is Affected By Multiple Vulnerabilities in the Debug Server

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking.

    IBM i
  • High 7.6
    CVE-2026-16961

    IBM i is Affected By SQL Injection Vulnerability in Db2 Mirror []

    IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

    IBM i
  • High 7.5
    CVE-2026-17271

    IBM i is Affected By Multiple Vulnerabilities in the Debug Server

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size.

    IBM i
  • High 7.1
    CVE-2026-17248

    IBM i is Affected By Multiple Vulnerabilities in the Debug Server

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command.

    IBM i

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://www.ibm.com/support/pages/node/7283274
  • Reference
    https://www.ibm.com/support/pages/node/7283275
  • Reference
    https://www.ibm.com/support/pages/node/7283276
  • Reference
    https://www.ibm.com/support/pages/node/7283277
  • Reference
    https://www.ibm.com/support/pages/node/7283278
  • Reference
    https://www.ibm.com/support/pages/node/7283280
  • Reference
    https://www.ibm.com/support/pages/node/7283282
  • Reference
    https://www.ibm.com/support/pages/node/7283294
  • Reference
    https://www.ibm.com/support/pages/node/7283295
  • Reference
    https://www.ibm.com/support/pages/node/7283296
  • Reference
    https://www.ibm.com/support/pages/node/7283298
  • Reference
    https://www.ibm.com/support/pages/node/7283299
  • Reference
    https://www.ibm.com/support/pages/node/7283300