i vulnerabilities and fixes

Recent CVEs affecting i, with upgrade or downgrade steps. 49 tracked.

i has 49 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 35. Most recent: 2026-10-16. Highest priority: CVE-2026-17218 (score 56/100).

• CVE-2026-18683 HIGH 8.8 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i
• CVE-2026-17095 HIGH 8.3 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due t
• CVE-2026-18847 HIGH 8.8 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoof
• CVE-2026-18098 HIGH 8.1 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and c
• CVE-2026-16694 MEDIUM 6.4 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting
• CVE-2026-17094 MEDIUM 4.3 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and m
• CVE-2026-18106 MEDIUM 4.3 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due t
• CVE-2026-18144 MEDIUM 4.3 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due t
• CVE-2026-18246 LOW 3.0 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due t
• CVE-2026-17218 CRITICAL 9.8 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds w
• CVE-2026-17083 CRITICAL 9.8 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buff
• CVE-2026-16860 CRITICAL 9.9 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an u
• CVE-2026-16906 HIGH 8.8 DOWNGRADE IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated pri
• CVE-2026-17417 HIGH 8.8 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to
• CVE-2026-17642 HIGH 8.8 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to
• CVE-2026-17110 HIGH 8.8 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obt
• CVE-2026-18669 HIGH 8.8 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution
• CVE-2026-17485 HIGH 8.2 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive i
• CVE-2026-16931 HIGH 7.5 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handli
• CVE-2026-17271 HIGH 7.5 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper valida
• CVE-2026-17276 CRITICAL 9.6 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to imprope
• CVE-2026-18713 HIGH 8.8 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i
• CVE-2026-17445 HIGH 8.2 DOWNGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due t
• CVE-2026-16856 HIGH 8.8 DOWNGRADE IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of
• CVE-2026-17082 HIGH 8.8 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to im
• CVE-2026-18235 HIGH 8.3 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language
• CVE-2026-16904 HIGH 8.1 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to
• CVE-2026-16907 HIGH 7.6 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to impr
• CVE-2026-16863 HIGH 7.7 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due t
• CVE-2026-18099 HIGH 8.9 DOWNGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due
• CVE-2026-17111 HIGH 7.6 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection
• CVE-2026-17248 HIGH 7.1 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to i
• CVE-2026-17266 MEDIUM 6.5 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due t
• CVE-2026-17418 HIGH 8.5 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to im
• CVE-2026-17419 MEDIUM 6.5 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper
• CVE-2026-17268 MEDIUM 6.8 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due t
• CVE-2026-17420 MEDIUM 6.3 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due t
• CVE-2026-18250 MEDIUM 6.3 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and b
• CVE-2026-17109 MEDIUM 4.3 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a com
• CVE-2026-17222 MEDIUM 4.3 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables
• CVE-2026-18148 MEDIUM 4.3 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navi
• CVE-2026-18150 MEDIUM 4.3 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due t
• CVE-2026-102917 HIGH 7.8 DOWNGRADE IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege
• CVE-2026-107674 MEDIUM 5.1 DOWNGRADE IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for Sys
• CVE-2026-17068 MEDIUM 5.4 DOWNGRADE IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper e
• CVE-2026-17073 MEDIUM 5.4 DOWNGRADE IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtr
• CVE-2026-17275 LOW 3.7 DOWNGRADE IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed
• CVE-2026-17488 MEDIUM 4.3 DOWNGRADE IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due t
• CVE-2026-17491 MEDIUM 5.4 DOWNGRADE IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions du

FAQ

How do I fix i vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is i being exploited right now?

None of the tracked i CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which i CVE should I patch first?

CVE-2026-17218 currently ranks highest (56/100): IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds w.

← Back to latest CVEs