CVE-2026-17206 is a high severity (CVSS 8.1) buffer overflow in IBM i Host Servers. A remote attacker could execute arbitrary code, though IBM rates the attack complexity as high. IBM lists PTFs for IBM i 7.3 to 7.6, and the fix is to apply the one for your release and test connections afterward.
What's affected
IBM i 7.6, 7.5, 7.4 and 7.3, in Host Servers. IBM's security bulletin was first published on 12 August 2026.
IBM lists fixes as PTFs for license program 5770-SS1:
- IBM i 7.6: PTF SJ11101 and SJ11097
- IBM i 7.5: PTF SJ11102 and SJ11098
- IBM i 7.4: PTF SJ11103 and SJ11099
- IBM i 7.3: PTF SJ11104 and SJ11100
IBM lists no workaround or mitigation for this issue. IBM also says to move off any unsupported release to a supported and fixed one.
How to check if you're exposed
Find your release and check whether the PTF for it is applied. On the IBM i command line, display the PTF status with the CL command below, using the PTF ID from the list above for your release.
DSPPTF LICPGM(5770SS1) SELECT(SJ11101)
A PTF that shows as permanently or temporarily applied counts as installed. One that is missing or only loaded needs action. Use the Host Servers PTF IDs, and check the QFileSvr.400 PTFs if you rely on that file system.
What to do now
- Identify every IBM i partition, including development and recovery systems, and record its release.
- Order and apply the PTF for your release from the table above, using IBM Fix Central or your usual PTF process.
- Test connections between partitions after the update, because stricter checks can break QFileSvr.400.
- Confirm the PTF status again after the IPL, if one is required, and keep the result for your records.
Why it matters
The weakness is CWE-787 (Out-of-bounds Write). A buffer overflow means data is written past the end of the space set aside for it. IBM says this one could let a remote attacker execute arbitrary code. The vector gives no privilege requirement and high impact on confidentiality, integrity and availability.
Memory flaws in a network service are a standing risk, because one mistake in parsing can hand over control. IBM's complexity rating of high suggests the attacker needs specific conditions. CISA does not list this CVE as known exploited.
Quick check
Is this fixed by the same PTFs as CVE-2026-17197?
Yes. Both are in the same IBM Host Servers bulletin and the PTFs listed above cover them.
Sources
Last reviewed: 19 October 2026.
