Skip to content
COOEY

FAIL › dossier

i

PRODUCT

· dossier confidence 50%

IBM i is an enterprise operating system that suffered a catastrophic security event in late 2026, with a single week yielding multiple critical and high-severity vulnerabilities including privilege escalation, arbitrary code execution, and SQL injection.

Failure events
16
Zero-days
0
RCEs
2
On KEV
0
Critical
2
Worst shame
78
PROFILE
CategoryOperating SystemWhat they doIBM i is an operating system for IBM Power Systems servers, providing enterprise-grade computing and database capabilities.
SECURITY POSTURE

The security posture is severely compromised by a concentrated burst of critical and high-severity vulnerabilities in late 2026, indicating systemic weaknesses in the core OS and its components.

Notable failures
  • CVE-2026-17276: Critical privilege escalation
  • CVE-2026-16860: Critical arbitrary code execution
  • CVE-2026-17197: High security bypass
  • CVE-2026-16961: High SQL injection
  • CVE-2026-18847: High unauthenticated host takeover
Patterns: repeated critical/high-severity remote code execution and privilege escalation; concentrated vulnerability bursts affecting multiple OS versions simultaneously; recurring SQL injection and security bypass flaws in core components
FAILURE HISTORY · 16
DATEEVENTSEVSUMMARY
2026-08-12 CVE-2026-16860 critical IBM i 7.3-7.6 systems allow remote authenticated attackers to execute arbitrary code via an uncontrolled search path element.
2026-08-12 CVE-2026-17276 critical IBM i 7.3-7.6 privilege escalation flaw allows authenticated remote attackers to escalate privileges via improper high-authority thread handling.
2026-06-22 CVE-2026-9072 high IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker i
2026-09-04 CVE-2026-18221 high CVE-2026-18221: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized
2026-09-04 CVE-2026-17207 medium CVE-2026-17207: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of
2026-09-04 CVE-2026-17057 medium CVE-2026-17057: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of
2026-08-13 CVE-2026-16961 high CVE-2026-16961: IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could s
2026-08-13 CVE-2026-17206 high CVE-2026-17206: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary
2026-08-13 CVE-2026-16867 high CVE-2026-16867: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server reso
2026-08-13 CVE-2026-17197 high CVE-2026-17197: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security re
2026-08-13 CVE-2026-18249 high CVE-2026-18249: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain
2026-08-13 CVE-2026-18193 high CVE-2026-18193: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security re
2026-08-13 CVE-2026-17101 high CVE-2026-17101: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary
2026-08-13 CVE-2026-16815 high CVE-2026-16815: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of
2026-08-12 CVE-2026-18847 high CVE-2026-18847: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to ha
2026-08-12 CVE-2026-17111 high CVE-2026-17111: IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker co
Open questions: Exact patch deployment timelines for the 2026 vulnerabilities · Whether any customer data was exfiltrated during the 2026 vulnerability window
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-12 18:01:16.679471+00:00