CVE-2026-17004 is a high severity (CVSS 7.5) infinite loop flaw in IBM i 7.3, 7.4, 7.5 and 7.6. A remote attacker with no account could cause a denial of service. IBM provides PTFs under 5770-SS1, listed per component in its bulletin.
What's affected
IBM i 7.6, 7.5, 7.4 and 7.3, per IBM's bulletin and the NVD record. IBM lists these PTFs for 5770-SS1:
- IBM i 7.6: SJ11101 and SJ11097 (Host Servers)
- IBM i 7.5: SJ11102 and SJ11098 (Host Servers)
- IBM i 7.4: SJ11103 and SJ11099 (Host Servers)
- IBM i 7.3: SJ11104 and SJ11100 (Host Servers)
IBM says to address the issue now and recommends that users of unsupported IBM i releases move to a supported, fixed version. This bulletin lists PTFs per component, so open it to find the right set for your exposure.
How to check if you're exposed
IBM i 7.3 through 7.6 are all in scope, so every supported and recently supported release needs a look. On each partition, confirm the installed release and then check whether the PTF for your release is loaded. From a command line:
DSPPTF LICPGM(5770SS1)
Look for the PTF number listed for your release in the table above, with a status of Applied or Permanently applied. You can also use option 10 of GO LICPGM to confirm the release. Do this on every LPAR, including test and recovery systems, because they are often patched last.
What to do now
- List every IBM i partition and its release, including test and disaster recovery systems.
- Find the PTF for your release in the table above, and order it from IBM Fix Central or through your usual PTF process.
- Apply the PTF and restart as the PTF cover letter requires.
- Check the PTF status with DSPPTF and record it.
- Limit access to IBM i network services to the hosts and users that need them.
Why it matters
CWE-835 is a loop with an unreachable exit condition. Specific input sends the code into a loop that never ends, tying up a process or thread. The vector shows no privileges and no interaction, with high availability impact and no effect on confidentiality or integrity.
Be aware that this bulletin covers many issues across IBM i components, and the table above shows only the Host Servers PTFs. IBM also lists PTFs for other components such as Debug Server, Telnet and DRDA/DDM, and a 13 August update adds QFileSvr.400 PTFs because the stricter Host Servers fixes can stop QFileSvr.400 from connecting in some cases. Read the bulletin to match the component to your CVE.
The weakness class here is CWE-835 (Loop with Unreachable Exit Condition). The NVD record scores it 7.5, which is high severity. IBM's bulletin gives the same score. The CVSS vector reads attack vector over the network, low attack complexity, no privileges required, no user interaction. Scope is unchanged. Impact on confidentiality, integrity and availability is rated none, none and high. The record's KEV flag is false, so this CVE is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.
Safeguard's Gold directory tracks this CVE, and reachability analysis helps you decide which affected components matter most for your own software.
Quick check
Could the Host Servers PTFs break anything?
IBM's 13 August update says QFileSvr.400 may not connect under certain circumstances after the stricter Host Servers PTFs, and lists separate PTFs to address it. Test before production.
Sources
- IBM security bulletin
- Safeguard Gold entry for CVE-2026-17004, which summarizes the NVD record
Last reviewed: 18 October 2026.
