CVE-2026-17197 is a high severity (CVSS 8.1) improper authentication flaw in IBM i Host Servers. The server did not properly validate the identity a client asserted, so a remote attacker could bypass security restrictions. IBM lists PTFs for 7.3 to 7.6, plus extra PTFs for QFileSvr.400 connections.
What's affected
IBM i 7.6, 7.5, 7.4 and 7.3, in Host Servers, the services that client tools use to reach IBM i. IBM's security bulletin was first published on 12 August 2026.
IBM lists fixes as PTFs for license program 5770-SS1:
- IBM i 7.6: PTF SJ11101 and SJ11097
- IBM i 7.5: PTF SJ11102 and SJ11098
- IBM i 7.4: PTF SJ11103 and SJ11099
- IBM i 7.3: PTF SJ11104 and SJ11100
IBM lists no workaround or mitigation for this issue. IBM also says to move off any unsupported release to a supported and fixed one.
How to check if you're exposed
Find your release and check whether the PTF for it is applied. On the IBM i command line, display the PTF status with the CL command below, using the PTF ID from the list above for your release.
DSPPTF LICPGM(5770SS1) SELECT(SJ11101)
A PTF that shows as permanently or temporarily applied counts as installed. One that is missing or only loaded needs action. Check the Host Servers PTF, and the QFileSvr.400 PTF if you use that file system between partitions.
What to do now
- Identify every IBM i partition, including development and recovery systems, and record its release.
- Order and apply the PTF for your release from the table above, using IBM Fix Central or your usual PTF process.
- Test remote file system connections between partitions after applying the PTFs, using the QFileSvr.400 fix if they fail.
- Confirm the PTF status again after the IPL, if one is required, and keep the result for your records.
Why it matters
The weakness is CWE-287 (Improper Authentication), in the form IBM describes as improper validation of client-asserted identity. When a server accepts a claim of identity from the client without checking it, an attacker can say they are someone else. The same bulletin includes a buffer overflow, CVE-2026-17206, so one PTF set covers both.
The vector marks complexity as high and gives high impact to confidentiality, integrity and availability. Test the QFileSvr.400 PTFs together with the main ones, as IBM warns that stricter checks can break some connections. CISA does not list this CVE as known exploited.
Quick check
Why does IBM list extra QFileSvr.400 PTFs?
The stricter security in the Host Servers PTFs can stop the QFileSvr.400 file system from connecting in some cases. IBM added PTFs on 13 August 2026 that address that.
Sources
Last reviewed: 19 October 2026.
