CVE-2026-17045

HighCVSS 8.1/10Last modified Aug 17, 2026

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-294

Affected software

No affected versions have been published.

Timeline

Published
Aug 13, 2026
Last modified
Aug 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-170475.4IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation.CVE-2026-170484.9A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system proceCVE-2026-17052.4A vulnerability was detected in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function ad_virtual_server_vdsl of the comCVE-2026-170505.7The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap iCVE-2026-170516.0The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). ICVE-2026-170527.8The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validatedCVE-2026-170534.4The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls. Their verifiers in drivers/smbCVE-2026-170545.3The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_eveCVE-2026-170579.1IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and affect data integrity due to missing authenticatCVE-2026-170596.5A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and accesCVE-2026-17066.1The All-in-One Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'vi' parameter in all versions up CVE-2026-170609.1IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service du