low · CVSS v3 3.7 · EPSS 0.00187
CVE-2026-17275
IBM i versions 7.3 through 7.6 allow a remote attacker to manipulate distributed transactions due to improper validation of transaction iden
Overview
IBM i versions 7.3 through 7.6 allow a remote attacker to manipulate distributed transactions due to improper validation of transaction identifiers. This flaw can enable unauthorized changes to transaction state. It is important for administrators to address the issue promptly.
Description
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.
Impact
The vulnerability can compromise confidentiality, integrity, and availability of distributed transaction data. Attackers may alter transaction outcomes, leading to data loss or corruption. Defenders should monitor transaction logs for anomalies.
Remediation
Apply the IBM i security patch that enforces proper validation of transaction identifiers. If possible, restrict remote transaction initiation to trusted hosts. Regularly audit transaction logs for suspicious activity.
Risk context
Severity is low and EPSS is 0.00187, indicating a very low likelihood of exploitation. However, because the flaw can affect critical transaction processing, patching should be performed as part of routine maintenance.
Affected products
- IBM i 7.3
- IBM i 7.4
- IBM i 7.5
- IBM i 7.6
Scores
- Severity
- low
- CVSS v2
- 2.6
- CVSS v3
- 3.7
- CVSS v4
- —
- EPSS
- 0.00187