CVE-2026-17255 is a denial of service flaw in IBM i 7.6, 7.5, 7.4 and 7.3. The system does not properly validate the prefix length in ICMPv6 Router Advertisements. It scores 4.3, Medium. IBM's fix is PTF MJ11322, MJ11323, MJ11324 or MJ11325 for licensed program 5770-999, depending on release.
What's affected
IBM i 7.3, 7.4, 7.5 and 7.6, licensed program 5770-999. IBM published the bulletin on 2 September 2026 with one PTF per release:
- 7.6: MJ11322
- 7.5: MJ11323
- 7.4: MJ11324
- 7.3: MJ11325
IBM lists no workaround.
The record scores it 4.3 (Medium) with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. One thing to read carefully: the record describes a remote attacker, but the CVSS vector, AV:A, is adjacent network. IBM's bulletin carries the same vector. The practical reading is that the attacker must be on the same local network segment, which is why the score is low.
How to check if you're exposed
IBM i exposure comes down to release and PTF level. First confirm which release you run (option 10 of GO LICPGM lists installed licensed programs and their releases). Then check whether the fixing PTF for your release is loaded and applied.
DSPPTF LICPGM(5770999) SELECT(MJ11322)
Swap in the PTF number for your release from the table above. If the command reports the PTF as not found, you do not have the fix. Run the command without the SELECT parameter to list every PTF for that product. If a PTF shows as loaded but not applied, finish it through your normal PTF process before you count it as done.
Use MJ11323, MJ11324 or MJ11325 for the other releases. IPv6 router advertisements only matter on networks where IPv6 is enabled, so also check whether your partitions have IPv6 interfaces configured. The advisory does not say that disabling IPv6 is a mitigation, so treat that as a question for IBM Support rather than a fix.
What to do now
- Identify IBM i partitions with IPv6 interfaces on shared network segments.
- Apply the PTF for your release: MJ11322, MJ11323, MJ11324 or MJ11325.
- Review who can send router advertisements on those segments. Switch-level controls that block rogue advertisements are a normal hardening step for any IPv6 network.
- Schedule the PTF in your regular maintenance window. The score is Medium and the vector is adjacent only, so this is not an emergency change, but it should not wait for the next release upgrade.
- IBM lists no workaround for this bulletin, and recommends that anyone on an unsupported release move to a supported and fixed version.
Why it matters
The record classes the weakness as CWE-787, Out-of-bounds Write. ICMPv6 Router Advertisements are how IPv6 routers tell hosts about network prefixes. Each advertisement carries a prefix length, which is a number with a defined valid range. IBM says IBM i did not properly validate that value. The record classes the flaw as an out-of-bounds write, which suggests the number was used to size or index memory without a check. The advisory does not go further than that, and neither will we.
The impact is availability only. The vector gives low availability impact and nothing for confidentiality or integrity. Because the attacker must be on the same network segment, the exposure is limited to places where untrusted devices share a layer 2 network with the IBM i system. That is a short list in most data centres and a longer one in labs and flat office networks.
This is a good example of a CVE where severity comes from where you run the system, not just the number. A Medium rating on an isolated management VLAN is routine maintenance. The same flaw on a shared segment is closer to an operational risk. It is not reported as exploited and is not in the CISA catalog.
Quick check
Is the attacker remote or local to the network?
The record says remote, but the vector is adjacent network. In practice the attacker has to send the packet from the same network segment.
Does this affect systems with IPv6 turned off?
The advisory does not say. Apply the PTF regardless, and ask IBM Support if you need a statement about IPv6-disabled systems.
Sources
- IBM Security Bulletin 7286093: IBM i ICMPv6, fetched 18 October 2026
Last reviewed: 18 October 2026.
