Technology · IBM
IBM i vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 120 vulnerabilities in IBM i: 1 in the last 7 days and 42 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-77153, was published on 8 November 2026. 15 vulnerabilities in the last four weeks, up 67% on the four before (9). 1 critical against 0.
- Last 7 days
- 1
- Last 90 days
- 42
- Critical, all time
- 5
- Exploited in the wild
- 0
About IBM i
IBM i is an operating system designed for IBM Power Systems, integrating a database, middleware, and security features.
Latest IBM i vulnerabilities
- CVE-2026-77153: IBM i missing authorization in Host-Based Printer SubsystemmediumCVSS 4.8
- CVE-2026-93744: IBM i Navigator authentication bypass via improper access controlmediumCVSS 6.5
- CVE-2026-17491: IBM i ChrootDirectory security restriction bypass in OpenSSHmediumCVSS 5.4
- CVE-2026-17488: IBM i improper authentication bypass in SST/DSTmediumCVSS 4.3
- CVE-2026-17073: IBM i file handle access control vulnerability in NFSmediumCVSS 5.4
- CVE-2026-17068: IBM i NFS version restriction bypassmediumCVSS 5.4
- CVE-2026-107674: IBM i Digital Certificate Manager denial of servicemediumCVSS 5.1
- CVE-2026-102917: IBM i privilege escalation in improper privilege managementhighCVSS 7.8
- CVE-2026-96119: IBM i code injection in HTTP Server AdministrationcriticalCVSS 9.9EPSS 0.5%
- CVE-2026-93886: IBM i cross-site scripting in HTTP Server Administration GUIhighCVSS 8.3EPSS 0.2%
- CVE-2026-81858: IBM i out-of-bounds read in File ServermediumCVSS 5.4EPSS 0.5%
- CVE-2026-18343: IBM i improper privilege management in BOOTP tablemediumCVSS 4.4EPSS 0.1%
- CVE-2026-18318: IBM i brute-force attack on authentication in DST/SSTmediumCVSS 5.3EPSS 0.3%
- CVE-2026-17487: IBM i user profile enumeration via sign-on error codesmediumCVSS 5.3EPSS 0.2%
- CVE-2026-17484: IBM i denial of service in DST/SST due to improper access controlmediumCVSS 5.3EPSS 0.1%
- CVE-2026-84414: IBM i incorrect permission assignment in Network Authentication ServicehighCVSS 7.8
- CVE-2026-18869: IBM i FTP server-side request forgery in PORT and EPRT commandsmediumCVSS 6.4EPSS 0.2%
- CVE-2026-17262: IBM i FTP authentication denial of servicemediumCVSS 5.4EPSS 0.2%
- CVE-2026-19280: IBM i buffer overflow in PASE processmediumCVSS 5.2EPSS 0.1%
- CVE-2026-19086: IBM i buffer overflow in PASE processlowCVSS 3.3EPSS 0.1%
- CVE-2026-18069: IBM i race condition in file ownership handlingmediumCVSS 6EPSS 0.1%
- CVE-2026-18251: IBM i WebSocket origin validation bypassmediumCVSS 4.3EPSS 0.1%
- CVE-2026-18515: IBM i path traversal in Navigator for imediumCVSS 4.3EPSS 0.3%
- CVE-2026-18151: IBM i Navigator race condition in WebSocket handshakemediumCVSS 4.2EPSS 0.1%
- CVE-2026-18221: IBM i improper authentication validation in DDM/DRDAhighCVSS 8.1EPSS 0.3%
Most severe IBM i vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-16860: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an…criticalCVSS 9.9EPSS 0.8%
- CVE-2026-96119: IBM i code injection in HTTP Server AdministrationcriticalCVSS 9.9EPSS 0.5%
- CVE-2026-17083: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.criticalCVSS 9.8EPSS 0.8%
- CVE-2026-17218: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.criticalCVSS 9.8EPSS 0.8%
- CVE-2026-17276: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper…criticalCVSS 9.6EPSS 0.5%
- CVE-2026-18193: IBM i security restriction bypass via improper address validationhighCVSS 8.9EPSS 0.4%
- CVE-2026-18099: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to…highCVSS 8.9EPSS 0.3%
- CVE-2026-17642: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper…highCVSS 8.8EPSS 0.8%
- CVE-2026-17417: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper…highCVSS 8.8EPSS 0.8%
- CVE-2026-16906: IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges…highCVSS 8.8EPSS 0.8%
Vulnerabilities per week
15 vulnerabilities in the last four weeks, up 67% on the four before (9). 1 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 18 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 8 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 1 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 13 | 1 | |
| 19 Oct 2026 | 1 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 1 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many IBM i vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/i)<a href="https://junglewise.ai/threats/technologies/i"><img src="https://junglewise.ai/threats/technologies/i/badge.svg" alt="IBM i vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/i.json, and this page as text at https://junglewise.ai/threats/technologies/i.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "IBM i vulnerabilities", https://junglewise.ai/threats/technologies/i, 12 November 2026.