CVE-2026-17276 is a critical (CVSS 9.6) improper privilege management flaw in IBM i. A remote authenticated attacker could escalate privileges because of how high-authority threads are handled. It is in IBM's Navigator for i bulletin, and the fix is the 5770-SS1 Option 3 PTF for your release.
What's affected
IBM i 7.6, 7.5, 7.4 and 7.3, in the Navigator for i bulletin. IBM's security bulletin was first published on 11 August 2026.
IBM lists fixes as PTFs for license program 5770-SS1 Option 3:
- IBM i 7.6: PTF SJ10887
- IBM i 7.5: PTF SJ10888
- IBM i 7.4: PTF SJ10890
- IBM i 7.3: PTF SJ10891
IBM lists no workaround or mitigation for this issue. IBM also says to move off any unsupported release to a supported and fixed one.
How to check if you're exposed
Find your release and check whether the PTF for it is applied. On the IBM i command line, display the PTF status with the CL command below, using the PTF ID from the list above for your release.
DSPPTF LICPGM(5770SS1) SELECT(SJ10887)
A PTF that shows as permanently or temporarily applied counts as installed. One that is missing or only loaded needs action. Also list user profiles that can sign on remotely, because the flaw needs a valid account.
What to do now
- Identify every IBM i partition, including development and recovery systems, and record its release.
- Order and apply the PTF for your release from the table above, using IBM Fix Central or your usual PTF process.
- Review remote sign-on accounts and special authorities, and remove what is not needed.
- Confirm the PTF status again after the IPL, if one is required, and keep the result for your records.
Why it matters
The weakness is CWE-269 (Improper Privilege Management). IBM says authorization was not handled correctly for high-authority threads, which lets a signed-on user gain more rights than they were given. The vector shows low privileges, no user interaction and a changed scope, with high confidentiality and integrity impact.
Privilege escalation turns a small compromise into a large one. A stolen ordinary account becomes a powerful one. That makes account hygiene and the PTF equally important here. CISA does not list this CVE as known exploited.
Quick check
Is this the same fix as CVE-2026-17101?
Yes. Both are in IBM security bulletin 7283292 and use the PTFs listed above.
Sources
Last reviewed: 19 October 2026.
