CVE-2026-17207 is a medium severity (CVSS 6.5) buffer overflow in the IBM i Network File System component. A remote attacker with no login could cause a denial of service and compromise integrity. IBM lists PTFs for IBM i 7.3, 7.4, 7.5 and 7.6, so apply the one for your release.
What's affected
IBM i 7.6, 7.5, 7.4 and 7.3, in the Network File System (NFS) server. IBM's security bulletin was first published on 31 August 2026.
IBM lists fixes as PTFs for license program 5770-SS1:
- IBM i 7.6: PTF SJ11320
- IBM i 7.5: PTF SJ11319
- IBM i 7.4: PTF SJ11318
- IBM i 7.3: PTF SJ11317
IBM lists no workaround or mitigation for this issue. IBM also says to move off any unsupported release to a supported and fixed one.
How to check if you're exposed
Find your release and check whether the PTF for it is applied. On the IBM i command line, display the PTF status with the CL command below, using the PTF ID from the list above for your release.
DSPPTF LICPGM(5770SS1) SELECT(SJ11320)
A PTF that shows as permanently or temporarily applied counts as installed. One that is missing or only loaded needs action. Check whether the NFS server is started and which networks can reach it.
What to do now
- Identify every IBM i partition, including development and recovery systems, and record its release.
- Order and apply the PTF for your release from the table above, using IBM Fix Central or your usual PTF process.
- Stop the NFS server if it is not in use.
- Confirm the PTF status again after the IPL, if one is required, and keep the result for your records.
Why it matters
The weakness is CWE-787 (Out-of-bounds Write). A buffer overflow in the NFS code lets data land outside its intended buffer. IBM names denial of service and an integrity effect, with no confidentiality impact, which is why the score is medium.
The vector shows no privileges and no user interaction, so reachability is the key question. If the NFS server is not running or is closed off from untrusted networks, practical risk falls, but the PTF is still the correct fix. CISA does not list this CVE as known exploited.
Quick check
What is the difference from CVE-2026-17057?
Both are in the NFS bulletin. 17057 is missing authentication for a critical function and 17207 is a buffer overflow. The same PTFs address both.
Sources
Last reviewed: 19 October 2026.
