CVE-2026-17101 is a high severity (CVSS 8.3) improper authentication flaw in Navigator for i, the IBM i web management tool. A remote attacker could run arbitrary code or obtain sensitive information. IBM lists PTFs for 7.3 to 7.6 under 5770-SS1 Option 3, and the fix is to apply the one for your release.
What's affected
IBM i 7.6, 7.5, 7.4 and 7.3, in Navigator for i, the web interface for managing IBM i. IBM's security bulletin was first published on 11 August 2026.
IBM lists fixes as PTFs for license program 5770-SS1 Option 3:
- IBM i 7.6: PTF SJ10887
- IBM i 7.5: PTF SJ10888
- IBM i 7.4: PTF SJ10890
- IBM i 7.3: PTF SJ10891
IBM lists no workaround or mitigation for this issue. IBM also says to move off any unsupported release to a supported and fixed one.
How to check if you're exposed
Find your release and check whether the PTF for it is applied. On the IBM i command line, display the PTF status with the CL command below, using the PTF ID from the list above for your release.
DSPPTF LICPGM(5770SS1) SELECT(SJ10887)
A PTF that shows as permanently or temporarily applied counts as installed. One that is missing or only loaded needs action. Also check which networks can reach the Navigator for i web ports.
What to do now
- Identify every IBM i partition, including development and recovery systems, and record its release.
- Order and apply the PTF for your release from the table above, using IBM Fix Central or your usual PTF process.
- Restrict access to the Navigator for i web interface to administrators and a management network.
- Confirm the PTF status again after the IPL, if one is required, and keep the result for your records.
Why it matters
The weakness is CWE-287 (Improper Authentication). The Navigator for i code did not verify identity properly, and IBM says this could let a remote attacker execute arbitrary code or read sensitive information. The vector marks complexity as high and user interaction as required, and a changed scope.
A management interface carries a lot of power, so authentication bugs there are worth fixing quickly. Put the web console behind a management network, not an open one. CISA does not list this CVE as known exploited.
Quick check
Which license program carries the fix?
The PTFs are for IBM i Release 5770-SS1 Option 3, per IBM.
Sources
Last reviewed: 19 October 2026.
