Quick answers
- Is CVE-2026-17487 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-17487 being exploited in the wild.
- How severe is CVE-2026-17487?
- Medium severity, with a CVSS score of 5.3, published 13 October 2026.
- Which products and versions are affected?
- IBM I 7.3, 7.4, 7.5, 7.6.
- Is there a fix for CVE-2026-17487?
- Yes: fixed in IBM i 7.6 with PTF MJ11636 or MJ11441; 7.5 with PTF MJ11635 or MJ11439; 7.4 with PTF MJ11634 or MJ11438; 7.3 with PTF MJ11633 or MJ11448. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-17487 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-17487?
- Check whether you run IBM I at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: IBM i 7.6 with PTF MJ11636 or MJ11441; 7.5 with PTF MJ11635 or MJ11439; 7.4 with PTF MJ11634 or MJ11438; 7.3 with PTF MJ11633 or MJ11448
Technical details
The vulnerability is an information disclosure flaw (CWE-200) in the IBM i sign-on process that returns distinct error codes to distinguish between invalid usernames and invalid passwords, allowing an unauthenticated network attacker to enumerate valid user profiles without authentication. The vulnerability affects the sign-on authentication mechanism in IBM i 7.3–7.6 and is exploitable without authentication or user interaction. Fixes are available via PTFs (MJ11636/MJ11441 for 7.6, MJ11635/MJ11439 for 7.5, MJ11634/MJ11438 for 7.4, MJ11633/MJ11448 for 7.3).
Affected products
- IBM i 7.3, 7.4, 7.5, 7.6
Timeline
- 2026-09-29: advisory: IBM Security Bulletin published
- 2026-10-13: disclosed