CVE-2026-17057 is a medium severity (CVSS 6.5) missing authentication flaw in the IBM i Network File System component. A remote attacker with no login could cause a denial of service and affect data integrity. IBM published PTFs for IBM i 7.3, 7.4, 7.5 and 7.6, so apply the one for your release.
What's affected
IBM i 7.6, 7.5, 7.4 and 7.3, in the Network File System (NFS) server. IBM's security bulletin was first published on 31 August 2026.
IBM lists fixes as PTFs for license program 5770-SS1:
- IBM i 7.6: PTF SJ11320
- IBM i 7.5: PTF SJ11319
- IBM i 7.4: PTF SJ11318
- IBM i 7.3: PTF SJ11317
IBM lists no workaround or mitigation for this issue. IBM also says to move off any unsupported release to a supported and fixed one.
How to check if you're exposed
Find your release and check whether the PTF for it is applied. On the IBM i command line, display the PTF status with the CL command below, using the PTF ID from the list above for your release.
DSPPTF LICPGM(5770SS1) SELECT(SJ11320)
A PTF that shows as permanently or temporarily applied counts as installed. One that is missing or only loaded needs action. Also check whether the NFS server job is active and which hosts can reach it.
What to do now
- Identify every IBM i partition, including development and recovery systems, and record its release.
- Order and apply the PTF for your release from the table above, using IBM Fix Central or your usual PTF process.
- If NFS is not needed, stop the server and remove exports.
- Confirm the PTF status again after the IPL, if one is required, and keep the result for your records.
Why it matters
The weakness is CWE-306 (Missing Authentication for Critical Function). A critical function in the NFS component could be called without proof of identity. IBM says a remote attacker could use this to cause a denial of service and affect data integrity.
The score is medium, mostly because the confidentiality impact is none. Medium does not mean ignore: the vector shows no privileges, no user interaction and low complexity. If NFS is exported on your IBM i system, it deserves a place in the same patch cycle as the higher scores. CISA does not list this CVE as known exploited.
Quick check
Is NFS on by default?
The pages we read do not say. Check whether the NFS server is started on each partition and whether exports exist.
Sources
Last reviewed: 19 October 2026.
