CVE-2026-17502 is an out-of-bounds write in IBM i NetServer, the SMB file sharing service, on IBM i 7.6, 7.5, 7.4 and 7.3. A remote attacker with no account can cause a denial of service. It scores 8.6, High. IBM's fix is PTF MJ10939, MJ10938, MJ10937 or MJ10936.
What's affected
IBM i 7.3, 7.4, 7.5 and 7.6, licensed program 5770-999. IBM's 12 August 2026 bulletin covers NetServer and lists:
- 7.6: MJ10939
- 7.5: MJ10938
- 7.4: MJ10937
- 7.3: MJ10936
The bulletin names 15 CVEs for NetServer. They include out-of-bounds reads, an integer overflow, a heap overflow, uninitialised memory used while processing ASN.1 lengths and an NTLM session authentication flaw rated 8.1. IBM lists no workaround.
The record scores it 8.6 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. The vector is network, low complexity, no privileges, with low confidentiality and integrity impact and high availability impact. IBM's bulletin gives the same 8.6.
How to check if you're exposed
IBM i exposure comes down to release and PTF level. First confirm which release you run (option 10 of GO LICPGM lists installed licensed programs and their releases). Then check whether the fixing PTF for your release is loaded and applied.
DSPPTF LICPGM(5770999) SELECT(MJ10939)
Swap in the PTF number for your release from the table above. If the command reports the PTF as not found, you do not have the fix. Run the command without the SELECT parameter to list every PTF for that product. If a PTF shows as loaded but not applied, finish it through your normal PTF process before you count it as done.
To know whether NetServer is exposed, check whether it is started and which networks can reach the SMB ports on the partition.
What to do now
- Find partitions with NetServer started, and which networks can reach their SMB ports.
- Apply the PTF for your release: MJ10936, MJ10937, MJ10938 or MJ10939.
- Block SMB from untrusted networks at the firewall. File sharing ports have no business on the open internet.
- Plan to apply the whole PTF, not a subset, since 15 CVEs share it.
- IBM lists no workaround for this bulletin, and recommends that anyone on an unsupported release move to a supported and fixed version.
Why it matters
The record classes the weakness as CWE-787, Out-of-bounds Write. An out-of-bounds write is a memory safety bug: the service writes data to a place outside the memory it was meant to touch. IBM states the result as a denial of service. The vector gives low confidentiality and integrity impact next to the high availability impact, which suggests that some memory is changed beyond a plain crash, but the advisory does not claim more than an outage.
NetServer is a network file sharing service, so the question is who can talk to it. In a normal environment, SMB is limited to internal networks. That limits the number of possible attackers, but it does not remove the risk from a compromised internal host. And no authentication is needed in the vector.
Fifteen CVEs in one bulletin is a sign of a component that took a thorough review. The right response is to take the full fix and tighten network access. Nothing in the record or the bulletin reports exploitation of this CVE, and it is not in the CISA catalog.
Quick check
What is NetServer?
It is the IBM i service that provides file and print sharing to Windows-style clients over SMB.
Do I need to patch all 15 CVEs separately?
No. The PTF for your release is the remediation for every CVE in the bulletin.
Sources
- IBM Security Bulletin 7283573: IBM i NetServer, fetched 18 October 2026
Last reviewed: 18 October 2026.
