IBM i: Out-of-bounds read in File Server causes denial of service
Summary
IBM i 7.3, 7.4, 7.5 and 7.6 contain an out-of-bounds read in the File Server (Host Servers). A remote attacker with valid credentials and network access can cause a denial of service and read memory contents, which may expose sensitive information. IBM's bulletin rates the CVSS 3.1 base score at 5.4, while the CVE record shows 8.1, so confirm the authoritative score before setting priority. No exploitation has been reported.
Affected
- IBM i 7.3 (5770-SS1)
- IBM i 7.4 (5770-SS1)
- IBM i 7.5 (5770-SS1)
- IBM i 7.6 (5770-SS1)
Fixed in
- IBM i 7.3: PTF SJ11619
- IBM i 7.4: PTF SJ11620
- IBM i 7.5: PTF SJ11621
- IBM i 7.6: PTF SJ11622
IBM recommends upgrading unsupported versions to a supported, fixed release.
Workaround
None (according to the IBM security bulletin).
Exploitation
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- No public proof of concept found; this reflects limited research, not confirmed absence.
- EPSS score low (0.00482).
Our recommendation
- Apply the PTF for your IBM i release (SJ11619 for 7.3, SJ11620 for 7.4, SJ11621 for 7.5, SJ11622 for 7.6) in the next regular maintenance window; verify the PTF level on your systems.
- Make sure no IBM i host server ports are reachable from the internet, and restrict network access to file-serving services.
- Review accounts with valid credentials and remove unneeded access.
- Raise the priority if IBM i host servers are reachable from outside the internal network.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin CVE-2026-81858 www.ibm.com
- Rapid7 via Vulners: CVE-2026-81858 vulners.com
- VulnCheck via Vulners: CVE-2026-81858 vulners.com
- CVE mirror: CVE-2026-81858 cve.threatint.com
- Strix: CVE-2026-81858 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:55.
Original description (NVD)
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.