PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6936 IBM CVE debrief

IBM i versions 7.3 through 7.6 contain a denial-of-service vulnerability in the Integrated Language Environment (ILE) compiler. The flaw stems from uncontrolled recursion (CWE-674) when processing specially crafted source code containing a specific combination of statements. An authenticated attacker with compilation privileges can trigger this condition, causing the compiler to exhaust system resources and resulting in service disruption. The vulnerability was disclosed by IBM PSIRT and published to the NVD on 2026-05-27. No known exploitation in ransomware campaigns has been reported, and the vulnerability is not listed in CISA KEV. Organizations should apply IBM's security updates and restrict compilation privileges to trusted users pending patching.

Vendor
IBM
Product
i
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-28
Advisory published
2026-05-27
Advisory updated
2026-05-28

Who should care

IBM i system administrators, security teams managing midrange infrastructure, developers with ILE compilation access, and organizations running RPG, COBOL, C, C++, or CL applications on IBM i 7.3-7.6

Technical summary

The ILE compiler in IBM i fails to properly limit recursion depth when parsing specific statement combinations in source code. An authenticated user can submit malicious source code that triggers excessive recursive calls, consuming stack memory or CPU resources and causing the compilation process—and potentially the subsystem—to become unresponsive. The vulnerability requires network access and valid authentication credentials but no user interaction. Impact is limited to availability (no confidentiality or integrity compromise).

Defensive priority

medium

Recommended defensive actions

  • Apply IBM security updates for affected IBM i versions (7.3, 7.4, 7.5, 7.6) as referenced in IBM's security advisory
  • Restrict ILE compilation privileges to authorized administrative users until patches are deployed
  • Monitor compiler processes for abnormal resource consumption or recursion depth anomalies
  • Review audit logs for compilation of untrusted or externally sourced source code
  • Validate source code through static analysis before compilation in production environments

Evidence notes

Vulnerability confirmed through official IBM security advisory and NVD entry. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. CWE-674 (Uncontrolled Recursion) identified as root cause. Affected versions explicitly listed as IBM i 7.3, 7.4, 7.5, and 7.6.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6936 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6936

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6936 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6936

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.