PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-17073 IBM CVE debrief

IBM i 7.3, 7.4, 7.5, and 7.6 are affected by improper authorization and access control vulnerabilities in Network File System. A local attacker could obtain sensitive information due to missing subtree checks during file handle resolution. This vulnerability allows local attackers to access sensitive information, emphasizing the need for defenders to verify and remediate affected IBM i systems, especially those with local access. The vulnerability's impact includes potential unauthorized access to sensitive data, highlighting the importance of reviewing system configurations and monitoring for exploitation attempts.

Vendor
IBM
Product
i
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-16
Original CVE updated
2026-10-21
Advisory published
2026-10-16
Advisory updated
2026-10-21

Who should care

Defenders responsible for IBM i systems, especially those with local access, should prioritize verifying and remediating this vulnerability.

Why it matters

IBM i 7.3, 7.4, 7.5, and 7.6 are affected by improper authorization and access control vulnerabilities in Network File System, allowing local attackers to obtain sensitive information.

  • Verify and remediate vulnerable IBM i systems to prevent local attackers from obtaining sensitive information
  • Review system configurations to ensure proper authorization and access control
  • Monitor for potential exploitation attempts to detect possible security breaches

Technical summary

IBM i 7.3, 7.4, 7.5, and 7.6 are affected by improper authorization and access control vulnerabilities in Network File System. A local attacker could obtain sensitive information due to missing subtree checks during file handle resolution. The vulnerability is a result of inadequate checks during file handle resolution, which could allow unauthorized access to sensitive information. Defenders should prioritize verifying and remediating this vulnerability in IBM i systems, especially those with local access, by reviewing system configurations, applying patches, and

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in IBM i systems, especially those with local access. This involves reviewing system configurations, applying patches, and monitoring for potential exploitation attempts.

Recommended defensive actions

  • Review and apply IBM patches for affected IBM i versions
  • Verify system configurations to prevent local attackers from obtaining sensitive information
  • Monitor for potential exploitation attempts

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-17073 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-17073

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-17073 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-17073

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.