IBM i security PTFs, August 2026: three things they break

Forty security vulnerabilities and 22 HIPER firmware patches landed on IBM i in a single week. That number is going to be the headline on the August 2026 IBM i security PTF batch everywhere it gets covered, and it is the least useful fact in the whole thing.

What matters is buried a few paragraphs into the following week’s bulletin: this batch has three documented ways to break your shop, and IBM has published a fix for none of them. If you are the person holding the change ticket, that is the part you need.

What landed in the August 2026 IBM i PTF batch

IT Jungle’s IBM i PTF Guide published Volume 28 Number 28 and Volume 28 Number 29 on the same day, 24 August. The Guide’s own archive dates the underlying issues 15 August and 22 August, so the newsletter ran roughly nine days behind the PTF drop and then released both at once. Anyone using IT Jungle as their security feed learned about a 40-CVE batch a week and a half after IBM published the bulletins. Doug Bidwell’s summary of Number 28 was accurate: “It looks like 28 is not your lucky number if you are an IBM i shop.”

The component list is long. Java SSE and the Java SDK, WebSphere Application Server Liberty across four separate bulletins, SMTP, DRDA and DDM across two, Digital Certificate Manager, Navigator for i, Host Servers, the Debug Server, Telnet, DNS, the Line Printer Daemon, PASE, SQL across three, DST and SST, Db2 Mirror for i, and NetServer. Number 29 added Host Servers again, a buffer overflow in Licensed Internal Code, Application Runtime Expert, and Electronic Service Agent.

Three remote code execution bulletins are in there. CVE-2026-16860 patches 5770-SS1 across 7.6 through 7.3 with SJ10879, SJ10880, SJ10881 and SJ10882. CVE-2026-17642 and CVE-2026-17417 take SJ10968, SJ10967, SJ10966 and SJ10964. CVE-2026-16975 hits Licensed Internal Code with MJ11019, MJ11050, MJ11051 and MJ11052. There are three privilege escalation bulletins on top of that, including CVE-2026-17438 in LDAP, plus OS command injection and SQL injection in Db2 Mirror.

One item is easy to miss because it does not run on the server. IBM Rational Developer for i 9.9.0.0 through 9.9.0.4 carries six CVEs. That is your developers’ workstations, and it will not show up in any IPL window you schedule.

Breakage one: the NetServer fix may kill your Linux mounts

The NetServer bulletin is the biggest single item in the batch. Fifteen CVEs in one document, published 12 August, affecting 7.6, 7.5, 7.4 and 7.3. The fix PTFs are MJ10939, MJ10938, MJ10937 and MJ10936 under 5770-999.

Start with the field most people skip. Under “Workarounds and Mitigations,” IBM wrote a single word: None. There is no configuration change that buys you time on this one. You patch or you stay exposed.

The severity spread backs that up. CVE-2026-17502 scores 8.6, an out-of-bounds write causing denial of service. CVE-2026-16858 scores 8.2 for the same class of flaw. CVE-2026-16868 scores 8.1 for use of uninitialized memory during ASN.1 length processing. And CVE-2026-16867, also 8.1, lets a remote attacker access server resources with the privileges of an authenticated user because of improper authentication during NTLM session negotiation.

That last one is where the trouble starts. The following week’s Guide flags a known issue: Linux mounts may fail to IBM i NetServer shares after applying the latest CVE PTFs from August 2026.

IBM has not published a mechanism, so treat this as a reasonable read rather than a confirmed cause. But the shape of the fix explains the symptom. If you close an authentication hole in NTLM session negotiation, you tighten what the server will accept during that negotiation. Linux clients using cifs or smbclient that are still negotiating the older path are exactly what stops working. IBM has documented this failure mode before in other contexts, where an NTLMv2 or SMB signing mismatch between client and server produces an access denied error or a network path not found.

Practically: inventory every Linux host that mounts a NetServer share before you schedule the window. Batch jobs writing to the IFS over a mount, backup scripts, report drops, anything that talks to a share from a non-Windows box. Test the mount on a patched LPAR first. If it breaks, you want to find that on a Tuesday afternoon, not at 2am with the production IPL already done.

Breakage two: older ACS drivers may stop connecting, and there is no fix

The second known issue is worse, because it reaches further than the server room.

Number 29 lists it plainly: security PTF enhancements can prevent connections from older versions of the IBM i Access Client Solutions Windows Application Package drivers. IBM has published an explanation and, in Bidwell’s words, “no fixes as yet.”

That is the ODBC, JDBC and OLE DB driver package on Windows workstations, not the ACS client itself. Every Excel connection, every Access database, every homegrown VB tool, every third-party reporting product pointed at Db2 for i through an old driver. Patch the server, and anything still running an outdated Application Package version may simply stop connecting. The failure will not look like a patch problem to the user. It will look like the report is broken.

The timing makes this harder. IBM i Access Client Solutions moved twice inside two weeks. Version 1.1.9.14 shipped with Number 28, and 1.1.9.15 followed in Number 29 to fix an SSL certificate error under APAR DT498800.

And 1.1.9.14 was itself a security release you cannot skip. Every prior version is vulnerable to arbitrary code execution on Windows when ACS is installed for all users, because of a publicly writeable directory and configuration file. Prior versions also allow injection of a rogue certificate authority through a publicly writeable truststore, and a zip slip path traversal when importing a configuration. Versions 1.1.8.3 through 1.1.9.13 will download unverified product code when configured to update from an IBM i.

So the workstation fleet is now part of your patch window whether you planned for it or not. Driver version and base ACS version are two separate audits, and neither one is covered by applying the ACS PTFs on the server. Inventory driver versions first, before you touch the server. If a machine is running something old enough to be blocked by the server-side change, it is also running something vulnerable enough that you needed to update it anyway.

Breakage three: SJ10844 is on both lists

This one requires reading two sections of the same bulletin and noticing a number appears in both.

In the security bulletin list, CVE-2026-17272 is a denial of service in the HTTP Server. The fixes are SJ10845 for 7.6, SJ10844 for 7.5, SJ10843 for 7.4 and SJ10842 for 7.3.

Further down, in the defective PTF table, the current defective for 7.5 is SJ10844. Defect date 08/13/26. APAR DT498871. Fixing PTF: available later.

The same number is on both lists in the same issue. A 7.5 shop working through this batch in order will reach the HTTP Server DoS, apply SJ10844, and be applying a PTF that IBM has separately flagged as defective with no replacement published.

Read the cover letter before you apply it. That advice sounds like boilerplate right up until it is the difference between a clean window and a rollback. The 7.6 defective, SJ10029 under APAR DT475474, has been open since 6 July with the same “available later” status, which tells you how long these can sit.

Twenty-two HIPER patches and a lot of “no news yet”

The HIPER firmware update side of this batch spans three processor generations. Power11 machines take firmware 1120.01 and 1110.31: the L1124, L1122, S1124, S1122, E1150 and E1180. All of those require an HMC. Power10 entry servers, the S1014, S1022s and S1022, take 1060.81. Power9 boxes, the E980, E950, S924, S914 and S922, take 950.H3.

Do not read 22 as 22 machines. Several models appear twice at different firmware levels, and the E980 and E950 are each listed twice at 950.H3. Same deduplication problem as the PTFs.

There is a real complaint here. The HIPER entries for the Power9 servers and the three Power10 entry boxes point at an IBM support page that had nothing on it, marked “no news yet.” IBM told customers a high impact pervasive firmware patch exists for their machine before publishing what it fixes. If you are running a Power10 or Power11 box, check that the detail page has actually populated before you plan around it.

Forty bulletins is not forty apply operations

Here is the one piece of good news, and it is genuinely useful.

Bulletin count is not PTF count. The same numbers repeat across different bulletins. SJ10887, SJ10888, SJ10890 and SJ10891 appear under both the privilege escalation bulletin for CVE-2026-18509 and the Navigator for i bulletin. SJ10899 appears under both Host Servers and the Debug Server. SJ10848 appears under both DRDA/DDM and Host Servers.

Build your actual list by PTF number, not by bulletin, and deduplicate before you estimate the window. The real work is meaningfully smaller than 40 security bulletins suggests. Bidwell also published a spreadsheet organizing the new PTFs by release level, linked from Number 28, which is the fastest way to do this without transcribing bulletin tables by hand.

If you are on 7.4, this is your last normal window

IBM i 7.4 transitions to Extended or Sustained support on 30 September 2026, per IBM’s own product lifecycle page, with extension availability running to 30 September 2029. It was withdrawn from market on 30 April. That is roughly five weeks after this batch.

Every 7.4 shop is applying these patches inside the last standard support window it gets. After September, security fixes come through a narrower, paid arrangement. This is a change of support rather than an end of support in the sense people usually mean it, the machine does not stop working, but the terms you get fixes under change and the budget line changes with them. IBM publishes the multipliers, and they start at 1.5 times your base SWMA and climb to 2.5 times by year three.

For the record, 7.3 still receives PTFs in this batch, because it sits on a Service Extension. It is not unsupported. IBM i 7.2 is the one getting nothing: the PTF group rundown for 7.2 in both issues reads “None.”

Bottom line

Do this in order, not in bulletin order.

Inventory ACS Application Package driver versions on workstations first, and update the outdated ones before the server changes. Then list every Linux host mounting a NetServer share and test those mounts on a patched test LPAR. Then build your PTF list by deduplicated number rather than by bulletin. Then read the cover letters on SJ10844 if you are on 7.5, and on the 7.6 defective if you are on 7.6. Then schedule the firmware separately, because the HMC requirement on Power11 and the E-class machines makes that a different job with a different risk profile.

The reason most shops will not do any of this is not incompetence. It is that they never built a patch cadence in the first place, which is a separate problem worth solving on its own. If you are the only person at your shop who knows how any of this works, the IBM i AI Field Guide is built for exactly that situation. But a batch this size with three known breakages is a bad one to improvise through. Fifteen CVEs in NetServer alone, with no workaround offered, is also a reminder that obscurity stopped being a security layer on this platform a while ago.

One last item from Number 29 if you run 7.6: IBM published recommended fixes for Cryptographic Services, Digital Certificate Manager and the Cryptographic Co-processor on 24 July, including MJ09823 for improved master key protection and MJ09825 for master key operations. That is the same master key machinery that complicates recovery after a DR event, so it deserves its own read rather than a place at the end of this list.

Frequently Asked Questions

How many CVEs are in the August 2026 IBM i security PTF batch?

IT Jungle counted 40 security vulnerabilities plus 22 HIPER firmware patches in Volume 28 Number 28 of the IBM i PTF Guide, with six more security bulletins following in Number 29. The NetServer bulletin alone accounts for 15 of those CVEs.

Will the August 2026 IBM i PTFs break Linux mounts to NetServer?

IBM has documented that Linux mounts may fail to IBM i NetServer shares after applying the August 2026 CVE PTFs. There is no fix published yet. Test a mount from every Linux host that touches a NetServer share before you commit the change in production.

Is SJ10844 safe to apply on IBM i 7.5?

SJ10844 is the 7.5 fix for the HTTP Server denial of service CVE-2026-17272, and it also appears on IBM’s defective PTF list with a defect date of 08/13/26 under APAR DT498871. The fixing PTF is listed as available later. Read the cover letter before you apply it.

When does IBM i 7.4 lose standard support?

IBM i 7.4 transitions to Extended or Sustained support on 30 September 2026, with extension availability running through 30 September 2029. It was withdrawn from market on 30 April 2026. Shops on 7.4 are applying this batch inside their last normal support window.