CVE-2026-17015

CVE-2026-17015 is an out-of-bounds read in an authenticated code path affecting IBM i versions 7.3 through 7.6. The four-version propagation is the most important signal here, but not for the reason most will assume. This isn't simply a bug carried forward across releases — it's evidence of a design doctrine that treated authentication as a substitute for input validation. The same flawed mental model persisted across four major versions, which means the underlying assumption that 'authenticated user input is safe' is baked into the codebase at a structural level, not just present in one function that got merged forward. The CVSS 5.4 score is misleading. An OOB read in an authenticated path on IBM i can leak memory from other jobs sharing the address space — database records, active sessions, credential caches. This isn't captured by the CVSS template, but it's the actual exploitation scenario. The low EPSS tells you this isn't weaponized yet, not that it isn't dangerous. Your prioritization should account for three factors that the CVE alone doesn't surface. First, what 'authenticated' means in your environment varies enormously — if you're running legacy RPG applications with shared service accounts, an authenticated attacker has broad reach. If you've modernized with Kerberos and object-level authority, the blast radius is tighter. Second, check whether your IBM i still runs integration subsystems connected to applications that have been replaced. An OOB read in forgotten code that executes via scheduled jobs or unaudited APIs is just as dangerous as one in active code. Third, remediation timelines on IBM i are measured in quarters, not days — the exposure window between 'flaw present' and 'flaw patched' compounds significantly, and the CVSS score has likely caused organizations to deprioritize this. Apply the 7.6 patch immediately. Then ask IBM whether the same authenticated code path was patched identically across 7.3, 7.4, and 7.5, or whether each version has its own instance of the flawed pattern. If it's the latter, expect similar flaws in adjacent code paths. The class of vulnerability — authenticated-path OOB reads stemming from implicit trust — almost certainly exists elsewhere in the IBM i codebase where it hasn't been found yet.

Reviewed through automated stages and approved by a human before publication.