CVE-2026-17068 (GCVE-0-2026-17068)
Vulnerability from cvelistv5
Published
2026-10-16 18:39
Modified
2026-10-16 21:16
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-285 - Improper Authorization
Summary
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17068",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:34:19.947700Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T21:16:16.013Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*"
],
"product": "i",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "7.6"
},
{
"status": "affected",
"version": "7.5"
},
{
"status": "affected",
"version": "7.4"
},
{
"status": "affected",
"version": "7.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.\u003c/p\u003e"
}
],
"value": "IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:39:45.465Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7292423"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eApplication of the PTFs require additional actions that if not taken will cause existing NFS mounts to become inaccessible. View each PTF\u0027s cover letter for the additional actions required prior to installation.\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003cthead\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eIBM i Release\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003e5770-SS1\u00a0\u003cbr/\u003ePTF Number(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003ePTF Download Link(s)\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e7.6\u003c/td\u003e\u003ctd\u003eSJ11753\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11753\" rel=\"nofollow\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ11753\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.5\u003c/td\u003e\u003ctd\u003eSJ11790\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11790\" rel=\"nofollow\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ11790\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.4\u003c/td\u003e\u003ctd\u003eSJ11802\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11802\" rel=\"nofollow\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ11802\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.3\u003c/td\u003e\u003ctd\u003eSJ11804\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11804\" rel=\"nofollow\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ11804\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003eIBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.\u003c/p\u003e"
}
],
"value": "Application of the PTFs require additional actions that if not taken will cause existing NFS mounts to become inaccessible. View each PTF\u0027s cover letter for the additional actions required prior to installation.\n\nIBM i Release5770-SS1\u00a0\nPTF Number(s)PTF Download Link(s)7.6SJ11753 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11753 7.5SJ11790 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11790 7.4SJ11802 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11802 7.3SJ11804 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11804 \n\n\n\nIBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products."
}
],
"title": "IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-17068",
"datePublished": "2026-10-16T18:39:45.465Z",
"dateReserved": "2026-07-24T14:02:31.328Z",
"dateUpdated": "2026-10-16T21:16:16.013Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-17068\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T19:34:19.947700Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T19:34:20.954Z\"}}], \"cna\": {\"title\": \"IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"i\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.6\"}, {\"status\": \"affected\", \"version\": \"7.5\"}, {\"status\": \"affected\", \"version\": \"7.4\"}, {\"status\": \"affected\", \"version\": \"7.3\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Application of the PTFs require additional actions that if not taken will cause existing NFS mounts to become inaccessible. View each PTF\u0027s cover letter for the additional actions required prior to installation.\\n\\nIBM i Release5770-SS1\\u00a0\\nPTF Number(s)PTF Download Link(s)7.6SJ11753 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11753 7.5SJ11790 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11790 7.4SJ11802 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11802 7.3SJ11804 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11804 \\n\\n\\n\\nIBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eApplication of the PTFs require additional actions that if not taken will cause existing NFS mounts to become inaccessible. View each PTF\u0027s cover letter for the additional actions required prior to installation.\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003cthead\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eIBM i Release\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003e5770-SS1\\u00a0\u003cbr/\u003ePTF Number(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003ePTF Download Link(s)\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e7.6\u003c/td\u003e\u003ctd\u003eSJ11753\u003c/td\u003e\u003ctd\u003e\u003ca href=\\\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11753\\\" rel=\\\"nofollow\\\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ11753\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.5\u003c/td\u003e\u003ctd\u003eSJ11790\u003c/td\u003e\u003ctd\u003e\u003ca href=\\\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11790\\\" rel=\\\"nofollow\\\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ11790\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.4\u003c/td\u003e\u003ctd\u003eSJ11802\u003c/td\u003e\u003ctd\u003e\u003ca href=\\\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11802\\\" rel=\\\"nofollow\\\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ11802\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.3\u003c/td\u003e\u003ctd\u003eSJ11804\u003c/td\u003e\u003ctd\u003e\u003ca href=\\\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11804\\\" rel=\\\"nofollow\\\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ11804\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003eIBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7292423\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"CWE-285 Improper Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2026-10-16T18:39:45.465Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-17068\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-16T21:16:16.013Z\", \"dateReserved\": \"2026-07-24T14:02:31.328Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2026-10-16T18:39:45.465Z\", \"assignerShortName\": \"ibm\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…