CVE-2026-17272 is an out-of-bounds write in the HTTP Server of IBM i 7.6, 7.5, 7.4 and 7.3. A remote attacker needs no account and can cause a denial of service. It scores 8.2, High. IBM's fix is PTF SJ10845, SJ11209, SJ10843 or SJ10842 for licensed program 5770-DG1, by release.
What's affected
IBM i 7.3, 7.4, 7.5 and 7.6, licensed program 5770-DG1, the HTTP Server. IBM lists one PTF per release:
- 7.6: SJ10845
- 7.5: SJ11209
- 7.4: SJ10843
- 7.3: SJ10842
The 7.5 entry changed. IBM's change history says that on 1 September 2026 the originally published 7.5 PTF, SJ10844, was replaced by SJ11209. If you downloaded SJ10844 earlier, get the new one.
The record scores it 8.2 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. The vector reads network access, low complexity, no privileges, low integrity impact and high availability impact. IBM's bulletin carries the same score.
How to check if you're exposed
IBM i exposure comes down to release and PTF level. First confirm which release you run (option 10 of GO LICPGM lists installed licensed programs and their releases). Then check whether the fixing PTF for your release is loaded and applied.
DSPPTF LICPGM(5770DG1) SELECT(SJ10845)
Swap in the PTF number for your release from the table above. If the command reports the PTF as not found, you do not have the fix. Run the command without the SELECT parameter to list every PTF for that product. If a PTF shows as loaded but not applied, finish it through your normal PTF process before you count it as done.
On 7.5, look for SJ11209 and do not stop at SJ10844. To see how exposed you are, look at whether any HTTP server instances are started on the partition and which networks can reach them. If 5770-DG1 appears in your licensed program list the code is installed even when no instance is running, so patch on the normal schedule either way.
What to do now
- Find IBM i partitions with 5770-DG1 installed and note which have HTTP server instances running and reachable.
- Apply the PTF for your release. On 7.5 make sure it is SJ11209, not the earlier SJ10844.
- Restrict network access to HTTP server instances that do not need to be public, and place web-facing ones behind a firewall rule set that you control.
- Watch for HTTP server job failures or restarts on unpatched partitions until the PTF is applied.
- IBM lists no workaround for this bulletin, and recommends that anyone on an unsupported release move to a supported and fixed version.
Why it matters
The record classes the weakness as CWE-787, Out-of-bounds Write. The description is short: a buffer overflow that lets a remote attacker cause a denial of service. The record classes it as an out-of-bounds write, where the program writes data past the end of a memory region it owns. The vector includes a low integrity impact, which hints that some memory is being altered, but IBM only claims a denial of service and we do not claim more.
The reason this one scores 8.2 is plain. It needs no account, no special conditions and no user action. Anyone who can send traffic to an HTTP server instance can try it. That is why the first move is to find out what is actually exposed, rather than to ask whether a patch exists.
Web server crashes are often handled with restarts and ignored. For a platform like IBM i that runs the business application stack, repeated crashes of a front-end service can be a real outage, and out-of-bounds writes deserve patching even if the stated impact looks small. This CVE is not reported as exploited and is not listed by CISA.
Quick check
Why did the 7.5 PTF number change?
IBM's change history says SJ10844 was updated to SJ11209 on 1 September 2026. Use the later number.
Is a reverse proxy a fix?
No. It can reduce direct exposure, but the vulnerable code stays on the system. Apply the PTF.
Sources
- IBM Security Bulletin 7283295: IBM i HTTP Server, fetched 18 October 2026
Last reviewed: 18 October 2026.
