CVE-2026-17199 is a denial of service flaw in IBM i 7.6, 7.5, 7.4 and 7.3, caused by unbounded resource allocation in the host servers. A remote attacker needs no account. It scores 7.5, High. IBM's fix is a pair of PTFs per release for licensed program 5770-SS1, plus follow-up PTFs for QFileSvr.400.
What's affected
IBM i 7.3, 7.4, 7.5 and 7.6, licensed program 5770-SS1. IBM's bulletin covers the host servers and several related components, and lists these PTFs for the Host Servers fix:
- 7.6: SJ11101 and SJ11097
- 7.5: SJ11102 and SJ11098
- 7.4: SJ11103 and SJ11099
- 7.3: SJ11104 and SJ11100
On 13 August 2026 IBM added a note. Because the Host Servers PTFs raise security requirements, the QFileSvr.400 file system may fail to connect in some circumstances. Separate PTFs address that: SJ11191 (7.6), SJ11190 (7.5), SJ11189 (7.4) and SJ11188 (7.3).
The record scores it 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
How to check if you're exposed
IBM i exposure comes down to release and PTF level. First confirm which release you run (option 10 of GO LICPGM lists installed licensed programs and their releases). Then check whether the fixing PTF for your release is loaded and applied.
DSPPTF LICPGM(5770SS1) SELECT(SJ11101)
Swap in the PTF number for your release from the table above. If the command reports the PTF as not found, you do not have the fix. Run the command without the SELECT parameter to list every PTF for that product. If a PTF shows as loaded but not applied, finish it through your normal PTF process before you count it as done.
Check both PTFs listed for your release, and then the QFileSvr.400 PTF if you use remote file system connections between IBM i systems.
What to do now
- List your IBM i partitions by release (7.3 to 7.6) and flag any that expose the host servers to networks beyond a trusted management range.
- Load and apply both Host Servers PTFs for your release from the list above.
- If you use QFileSvr.400 connections, apply the matching QFileSvr.400 PTF in the same change so those connections keep working under the stricter requirements.
- Test remote file system and client connections after the change, since IBM says the tighter requirements can break QFileSvr.400.
- IBM lists no workaround for this bulletin, and recommends that anyone on an unsupported release move to a supported and fixed version.
Why it matters
The record classes the weakness as CWE-770, Allocation of Resources Without Limits or Throttling. The weakness is a service that hands out memory, connections or processing time with no cap. An attacker who can reach the service sends requests that make it hold more and more, and eventually legitimate clients are refused. The vector reads network access, low complexity, no privileges and no user interaction, with the impact limited to availability.
Availability bugs get less attention than code execution, but on IBM i they hit core business systems. The host servers carry the connections that applications, ODBC and file clients use. A denial of service there is an outage for whatever sits on top.
The bulletin lists twelve CVEs across host servers, debug and Telnet and DRDA/DDM components, from infinite loops to buffer overflows to an identity assertion bypass. Treat the PTF set as one project. Nothing in the record or the bulletin reports exploitation of this CVE, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Why are there two PTFs for each release?
IBM's table lists a pair for host servers on each release. Apply both and check the bulletin if your PTF tooling shows one as superseded.
What does the QFileSvr.400 note mean?
IBM says the stricter requirements from the Host Servers PTFs can stop QFileSvr.400 from connecting in some cases, and publishes separate PTFs to fix that.
Sources
- IBM Security Bulletin 7283578: IBM i host servers, fetched 18 October 2026
Last reviewed: 18 October 2026.
