# CVE-2026-17262: IBM i FTP authentication denial of service

Source: https://junglewise.ai/threats/cve-2026-17262-ibm-i-7-6-7-5-7-4-and-7-3-could-allow-a-local-attacker-to-cause-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-17262 · Severity: medium · CVSS 5.4 · Published 2026-09-18

IBM i is a business-critical operating system that runs on enterprise servers. An improper validation flaw in the FTP (File Transfer Protocol) service allows local attackers to cause denial of service by sending specially crafted FTP authentication commands, potentially disrupting file transfer operations and system availability.

Technologies: [IBM I](https://junglewise.ai/threats/technologies/i). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-17262 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17262 being exploited in the wild.

**How severe is CVE-2026-17262?** Medium severity, with a CVSS score of 5.4, published 18 September 2026.

**Which products and versions are affected?** IBM I 7.3, 7.4, 7.5, 7.6.

**Is there a fix for CVE-2026-17262?** A patch was published on 2026-09-18: PTFs released for versions 7.3 (SJ11384), 7.4 (SJ11383), 7.5 (SJ11382), 7.6 (SJ11371) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-17262 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2026-17262?** Check whether you run IBM I at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A CWE-78 OS command injection vulnerability in IBM i's FTP implementation fails to properly validate authentication commands, allowing local attackers to trigger a denial of service condition. The vulnerability requires local access (adjacent network vector per CVSS vector AV:A) and no authentication, resulting in integrity and availability impact. Patches are available as PTFs for all affected versions.

## Affected products

- IBM i 7.3, 7.4, 7.5, 7.6

## Timeline

- 2026-09-18: disclosed: IBM security bulletin published
- 2026-09-18: patched: PTFs released for versions 7.3 (SJ11384), 7.4 (SJ11383), 7.5 (SJ11382), 7.6 (SJ11371)

## References

- [https://www.ibm.com/support/pages/node/7287873](https://www.ibm.com/support/pages/node/7287873)

## Related threats

- [IBM i Navigator authentication bypass via improper access control](https://junglewise.ai/threats/cve-2026-93744-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-an-unathenticated-remote)
- [IBM i ChrootDirectory security restriction bypass in OpenSSH](https://junglewise.ai/threats/cve-2026-17491-ibm-i-7-3-7-4-7-5-and-7-6-is-could-allow-a-remote-authenticated)
- [IBM i improper authentication bypass in SST/DST](https://junglewise.ai/threats/cve-2026-17488-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-remote-authenticated)
- [IBM i file handle access control vulnerability in NFS](https://junglewise.ai/threats/cve-2026-17073-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-local-attacker-to-obtain)
- [IBM i NFS version restriction bypass](https://junglewise.ai/threats/cve-2026-17068-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-local-attacker-to-bypass)