CVE-2026-17487 in IBM
Summary
by MITRE • 10/13/2026
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in IBM i operating system versions 7.3 through 7.6 represents a classic information disclosure flaw that stems from inconsistent error handling mechanisms within the authentication subsystem. Specifically, when an attacker attempts to authenticate against the system using invalid credentials or non-existent user profiles, the service returns distinct and distinguishable error codes depending on whether the username is valid but the password is incorrect, versus when the username itself does not exist in the system profile database. This behavior creates a side channel that allows remote attackers to perform user enumeration attacks without requiring prior knowledge of specific account names or passwords. By systematically testing various usernames and analyzing the resulting HTTP status codes or application error messages, an adversary can effectively map out which accounts are active on the target infrastructure, thereby gaining valuable intelligence for subsequent attack phases such as targeted password spraying or credential stuffing campaigns.
From a technical perspective, this flaw is categorized under CWE-203: Observable Discrepancy and falls squarely within the ATT&CK technique T1087.004, which covers Account Enumeration on Cloud Accounts or local systems. The root cause lies in the application logic that fails to normalize error responses for different failure conditions during the sign-on process. Instead of returning a generic authentication failure message regardless of whether the username is valid or invalid, the system leaks internal state information through its response payload. This lack of uniformity violates fundamental security design principles regarding consistent feedback mechanisms, which are intended to prevent attackers from gathering intelligence about the target environment. The vulnerability affects multiple versions of IBM i, indicating a systemic issue in how the operating system's authentication services handle credential validation across different releases and configurations.
The operational impact of this vulnerability is significant for organizations relying on IBM i systems for critical business operations. While user enumeration alone does not provide direct access to the system or data, it serves as a powerful reconnaissance tool that lowers the barrier for further exploitation. Attackers can use the enumerated list of valid usernames to prioritize their efforts, focusing brute-force attacks only on accounts known to exist rather than wasting resources on non-existent profiles. This increases the efficiency and success rate of subsequent attack vectors. Furthermore, in environments where password policies are weak or users reuse credentials across multiple services, successful enumeration combined with other data breaches can lead to full account compromise. The exposure also aids attackers in social engineering efforts by providing a list of legitimate employees or system accounts that can be impersonated in phishing campaigns.
To mitigate this vulnerability, organizations must ensure they have applied the latest security patches and updates provided by IBM for their respective versions of IBM i 7.3 through 7.6. These updates typically include fixes to the authentication service logic that normalize error responses, ensuring that both invalid usernames and incorrect passwords result in identical generic failure messages. In addition to patching, administrators should implement network-level controls such as rate limiting on login endpoints to slow down automated enumeration attempts. Multi-factor authentication (MFA) should be enforced for all remote access scenarios to add a layer of security that remains effective even if user credentials are compromised or enumerated. Regular monitoring and logging of failed login attempts can also help detect ongoing enumeration activities, allowing security teams to respond proactively before an attacker gains sufficient intelligence to launch more severe attacks.