Skip to content
OpenAdvisories
High WID-SEC-2026-2759 19 CVEs

IBM i: Mehrere Schwachstellen

Published Aug 11, 2026 · Updated Aug 13, 2026 · Revision 3 · de-DE

Vendor: IBM Product: i

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM i ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen SQL-Injection Angriff durchzuführen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.

Product

IBM i (früher bekannt als IBM iSeries oder IBM System i) ist ein Betriebssystem, das auf IBM Power Systems Servern läuft und für Geschäftsanwendungen entwickelt wurde.

Vulnerabilities 19

  • Critical 9.9
    CVE-2026-16860

    IBM i is Affected By Remote Code Execution Vulnerability []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.

    IBM i
  • Critical 9.8
    CVE-2026-17083

    IBM i is Affected By Multiple Vulnerabilities in the Debug Server

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.

    IBM i
  • Critical 9.8
    CVE-2026-17218

    IBM i is Affected By Remote Code Execution Vulnerability in Line Printer Daemon []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

    IBM i
  • High 8.8
    CVE-2026-16722

    IBM i is Affected By An Unauthorized Privileges Vulnerability in SQL []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management.

    IBM i
  • High 8.8
    CVE-2026-16975

    IBM i is Affected By A Remote Code Execution Vulnerability []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a heap-based buffer overflow.

    IBM i
  • High 8.8
    CVE-2026-16987

    IBM i is Affected By An Improper Validation Vulnerability in PASE []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable.

    IBM i
  • High 8.8
    CVE-2026-17082

    IBM i is Affected By Multiple Vulnerabilities in the Debug Server

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name.

    IBM i
  • High 8.8
    CVE-2026-17417

    IBM i is Affected By Remote Code Execution Vulnerabilities [, ]

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters.

    IBM i
  • High 8.8
    CVE-2026-17642

    IBM i is Affected By Remote Code Execution Vulnerabilities [, ]

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

    IBM i
  • High 8.8
    CVE-2026-18669

    IBM i is Affected By A Privilege Escalation Vulnerability []

    IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component. An authenticated attacker can execute a maliciously planted script with root authority.

    IBM i
  • High 8.5
    CVE-2026-16908

    IBM i is Affected By Multiple SQL Vulnerabilities [, ]

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path traversal vulnerability.

    IBM i
  • High 8.5
    CVE-2026-16967

    IBM i is Affected By Multiple SQL Vulnerabilities [, ]

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system objects due to a time-of-check to time-of-use (TOCTOU) race condition involving symbolic links.

    IBM i
  • High 8.2
    CVE-2026-17272

    IBM i is Affected By a Denial of Service in HTTP Server []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.

    IBM i
  • High 8.2
    CVE-2026-17445

    IBM i is Affected By Improper Validation Vulnerability in Line Printer Daemon []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile name.

    IBM i
  • High 7.7
    CVE-2026-16863

    IBM i is Affected By Out-of-Bounds Read Vulnerability []

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.

    IBM i
  • High 7.6
    CVE-2026-16907

    IBM i is Affected By Multiple Vulnerabilities in the Debug Server

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking.

    IBM i
  • High 7.6
    CVE-2026-16961

    IBM i is Affected By SQL Injection Vulnerability in Db2 Mirror []

    IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

    IBM i
  • High 7.5
    CVE-2026-17271

    IBM i is Affected By Multiple Vulnerabilities in the Debug Server

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size.

    IBM i
  • High 7.1
    CVE-2026-17248

    IBM i is Affected By Multiple Vulnerabilities in the Debug Server

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command.

    IBM i

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-58385, EUVD-2026-58384, EUVD-2026-58382, EUVD-2026-58381, EUVD-2026-58380, EUVD-2026-58367, EUVD-2026-58404

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-57387, EUVD-2026-57386, EUVD-2026-57385, EUVD-2026-57384, EUVD-2026-57379, EUVD-2026-57381, EUVD-2026-57532, EUVD-2026-57521, EUVD-2026-57520, EUVD-2026-57519, EUVD-2026-57517, EUVD-2026-57383

  3. #1

    Initiale Fassung

References