CVE-2026-17499 is an OS command injection flaw in the Debug Server of IBM i 7.6, 7.5, 7.4 and 7.3. IBM says a local attacker could execute arbitrary commands. It scores 4.4, Medium. IBM's fix is PTF SJ11305, SJ11306, SJ11307 or SJ11308 for licensed program 5770-SS1, by release.
What's affected
IBM i 7.3, 7.4, 7.5 and 7.6, licensed program 5770-SS1. IBM's 31 August 2026 bulletin covers eight Debug Server CVEs and lists:
- 7.6: SJ11305
- 7.5: SJ11306
- 7.4: SJ11307
- 7.3: SJ11308
IBM lists no workaround. Sibling issues in the bulletin include another local command injection (CVE-2026-16826, rated 5.3), a CL parameter injection (CVE-2026-18073) and weak server seeds (CVE-2026-17274).
The record scores it 4.4 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The vector is local, low complexity and low privileges, with low integrity and low availability impact. IBM's bulletin gives the same 4.4.
How to check if you're exposed
IBM i exposure comes down to release and PTF level. First confirm which release you run (option 10 of GO LICPGM lists installed licensed programs and their releases). Then check whether the fixing PTF for your release is loaded and applied.
DSPPTF LICPGM(5770SS1) SELECT(SJ11305)
Swap in the PTF number for your release from the table above. If the command reports the PTF as not found, you do not have the fix. Run the command without the SELECT parameter to list every PTF for that product. If a PTF shows as loaded but not applied, finish it through your normal PTF process before you count it as done.
Also check whether the Debug Server is started on production partitions. A debug service that runs in production is an exposure of its own, apart from this CVE.
What to do now
- List which partitions run the Debug Server and who can sign in locally to them.
- Apply the PTF for your release: SJ11305, SJ11306, SJ11307 or SJ11308.
- Keep the Debug Server off production partitions unless you need it, and limit who may use it.
- Review authority for accounts that can start debug sessions. The vector needs only a low-privilege local account.
- IBM lists no workaround for this bulletin, and recommends that anyone on an unsupported release move to a supported and fixed version.
Why it matters
The record classes the weakness as CWE-78, OS Command Injection. OS command injection happens when a program passes input to a command interpreter without neutralising characters the interpreter treats specially. The input then adds to the command instead of just feeding it data. In IBM's words, a local attacker could execute arbitrary commands.
The score is modest because the attacker must already be on the system with an account, and the vector rates the effect as low for both integrity and availability. That is a judgement about the privileges the commands would run with, not a promise that the effect is small on every system. A debug service often runs with elevated authority, so the practical impact depends on how your Debug Server is configured.
Eight CVEs in this bulletin means a mix of injection, memory and randomness flaws in one component. Patching them together is the right call. The CVE is not reported as exploited and is not in the CISA catalog.
Quick check
Is a Medium score safe to defer?
It can wait for your normal window if only trusted staff have local access. If many people have shell or debug rights, move it up.
Which other flaws does the same PTF fix?
The bulletin lists eight Debug Server CVEs, including a second local OS command injection and a CL command parameter injection.
Sources
- IBM Security Bulletin 7285844: IBM i Debug Server, fetched 18 October 2026
Last reviewed: 18 October 2026.
