CVE-2026-17487
5.3MediumPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-200
Impact
Remote, unauthenticated attackers can enumerate valid user accounts by observing distinct error codes during authentication attempts. They only need network reachability to the sign-on service.
Root cause
The authentication service returns distinct error codes for valid versus invalid usernames during the sign-on process.
Affected systems
IBM i 7.3, 7.4, 7.5, and 7.6
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Apply the appropriate IBM PTF patch referenced in advisory node 7290096. If patching must wait, restrict network access to IBM i sign-on interfaces to trusted management networks or VPNs.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.
References
- https://www.ibm.com/support/pages/node/7290096PatchVendor Advisory