# CVE-2026-107674: IBM i Digital Certificate Manager denial of service

Source: https://junglewise.ai/threats/cve-2026-107674-ibm-i-7-3-7-4-7-5-and-7-6-is-vulnerable-to-a-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107674 · Severity: medium · CVSS 5.1 · Published 2026-10-16

IBM i is an operating system used for business-critical enterprise applications. The Digital Certificate Manager component, which secures network connections using TLS, is vulnerable to denial of service attacks. An attacker with high privileges could prevent secure services from starting or force them to use unencrypted connections, compromising the confidentiality of network traffic.

Technologies: [IBM I](https://junglewise.ai/threats/technologies/i). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-107674 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107674 being exploited in the wild.

**How severe is CVE-2026-107674?** Medium severity, with a CVSS score of 5.1, published 16 October 2026.

**Which products and versions are affected?** IBM I 7.3, 7.4, 7.5, 7.6.

**Is there a fix for CVE-2026-107674?** Yes: fixed in 7.3 (PTF SJ11843), 7.4 (PTF SJ11844), 7.5 (PTF SJ11845), 7.6 (PTF SJ11846). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107674 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-107674?** Check whether you run IBM I at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.3 (PTF SJ11843), 7.4 (PTF SJ11844), 7.5 (PTF SJ11845), 7.6 (PTF SJ11846)

## Technical details

This vulnerability is an improper locking issue (CWE-667) in the Digital Certificate Manager that handles System TLS for secure network connections. It requires local access and high privileges to exploit; an attacker can trigger a denial of service condition that prevents DCM from functioning, potentially forcing applications to fall back to non-secure communications. Fixes are available via PTFs for all affected versions.

## Affected products

- IBM i 7.3, 7.4, 7.5, 7.6

## Timeline

- 2026-10-13: disclosed

## References

- [https://www.ibm.com/support/pages/node/7292225](https://www.ibm.com/support/pages/node/7292225)

## Related threats

- [IBM i Navigator authentication bypass via improper access control](https://junglewise.ai/threats/cve-2026-93744-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-an-unathenticated-remote)
- [IBM i ChrootDirectory security restriction bypass in OpenSSH](https://junglewise.ai/threats/cve-2026-17491-ibm-i-7-3-7-4-7-5-and-7-6-is-could-allow-a-remote-authenticated)
- [IBM i improper authentication bypass in SST/DST](https://junglewise.ai/threats/cve-2026-17488-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-remote-authenticated)
- [IBM i file handle access control vulnerability in NFS](https://junglewise.ai/threats/cve-2026-17073-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-local-attacker-to-obtain)
- [IBM i NFS version restriction bypass](https://junglewise.ai/threats/cve-2026-17068-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-local-attacker-to-bypass)