First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-17268

MediumCVSS 6.8/10Last modified Oct 23, 2026

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
IBM	i	7.6; 7.5; 7.4; 7.3

References

https://www.ibm.com/support/pages/node/7283292Vendor Advisory

Timeline

Published: Aug 12, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-17279.1The Agentspace service was affected by a vulnerability that exposed sensitive information due to the use of predictable Google Cloud Storage CVE-2026-172705.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to a stack-based buffer overflow.CVE-2026-172717.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size.CVE-2026-172727.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.CVE-2026-172736.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference.CVE-2026-172745.4IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds.CVE-2026-172755.3IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper CVE-2026-172769.9IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handlin CVE-2026-172787.5IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime con CVE-2026-172796.5IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to cause a denial of se CVE-2026-17289.8Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. E CVE-2026-172809.1IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform unauthenticated brute-forc

CVE-2026-17268: Medium severity, CVSS 6.8 | Vulnix